Can someone explain how reading the code from the spoofed email compromised his account?