Re: So why
"The more important question is how did the crooks know the phone number associated with the account."
One example scenario where this happens is because people running small businesses are (necessarily) publishing their phone number and contact email addresses - but using an address@ gmail or whoever instead of an address at their own domain (if they even have a domain name to start with).
Biting the hand that feeds IT
