GP attack vector was probably recruiter editing the CV to put their company name in some place and forward it to some client. They are lazy enough to not even copy-paste the CV.