They might have been a victim of phishing themselves. The email may not have come from them at all. Just a thought...