A pretty good email scam

A detailed account of a sophisticated email scam that used hidden forwarding rules and reply-to settings to maintain access after password changes. The attacker set up forwarding to a fake email address labeled as 'Default Forwarding' and configured reply-to addresses to intercept all communications. The incident highlights the importance of checking email account settings beyond just changing passwords when recovering from compromised accounts.