Good point. I'm willing to bet it was spear phishing. Really, really effective, and I don't believe there is a solution besides education and vigilance.