@craftxbox At least based off the profile I saw it looked like it was legitimate. I'd have to check through our e-mail logs (If I've even got that sort of thing being logged) to see if there was any sort of password reset / brute force / similar that allowed access but given there was no 2FA on the account and it was entirely inactive until this evening I'm guessing someone signed up, never used the account and used a crap password and it's been taken over for spam.