At the very least op should ask whoever sends her an email to confirm that they are user “mtklein” by updating his hn profile about section with a random, unique, string she generates or something. Just to be sure they are the right person. Also rip her inbox.