Emails started bouncing to the account around 05:00 GMT last night, it's likely that was one of the only ways the attacker could maintain communication.