not necessarily need a hack to your client mail server to do this. e mail can be spoofed easily (looks like coming from company A but actually coming from the scammer) and scammer always do that (like phishing) to deceive the receiver...

heard bout it but never actually handled such a case, yet...