My guess is that they did not know. I am hoping someone will see this, and recognise it. Maybe we could figure out together what is going on. The e-mail address from the DNS listing is found a couple of places on the internet, all in the same setting: Recepient from some e-mail service, nothing else.
My wife is not a techie, and I do not watch over her shoulder to make sure she does everything she should. And I must admit, this was an attack vector I did not foresee myself.
I was thinking about this too. I do not think it was a targeted attack. I guess my wife's e-mail and password from way back was found among the millions of leaked passwords that are available. It would be easy to find domains that are no longer existing in that list. And likewise easy to find if certain web sites would react positively to the e-mail address of the non-existing domain. And then it would just be a matter of registering the domain to get access, at least to some sites. What boggles me, is that someone actually does this. I can't see why.