Please read my post again, my theory covers that: "or she fell victim to a phishing attack (or account recovery hack)."