This sounds awfully suspicious in that they have such free rein to this account. It looks like an inside job to me since they can’t do a better job of monitoring these hackers. They better be looking within rather than outside the box. It is kinda like when you told your kids not to go outside at night because “there might be a boogy man outside and he might getcha.”