An odd looking email, followed up by a phone call and a suspicious ScreenConnect program installed - the timeline of a hack.