Also the email doesn't talk about the time-frame: when exactly did Evernote discover this activity and how long might they have been compromised for.