The screenshots in the text file supposedly show evidence that the attacker gained access to the actual GMX account, not a recycled one, since a) there are still messages in there and b) it seems that the account owner has been active, judging from the "replied to" icons in the inbox.