for? what exactly you want me to search for? ... the hacker got the user password and changed routing settings for the vendor addresses from webmail content filtering and started to communicate with the user from almost exact address (registered a domain without "s" in the last word). what exactly you want me to search for?
=====
I needed earlier alert since user change forward, password Events was useful but not enough.
By reporting abuse, a moderator will be asked to review the content of this interaction to take further action, if necessary.