@v
After further investigation with @danfinlay and team, it appears that the compromise was due to a registrar that has locked up the email domain.
It appears to have only affected this one account.
Some more details in thread about what we're doing next.