How did they know the internal mailing list address was [email protected]? Unless I'm missing something, sounds like this would require internal company knowledge.