My father and mother work at this University. The same login gets you into email, that gets you into payroll and all other employee areas of the employee website. So if the attacker was able to get the login and password through whatever means it would make any sort of email confirmation useless.

As far as the WMU police investigating this I think its a bit of a conflict of interest as their system was hacked and they will likely blame the 2 employees who lost their paychecks as its in the universities intrest no to send out more money.