tl;dr: they just used spearfishing, a poor man's facility to get someone to click on a link in a fake email you sent them.

This is quite low-tech.