[SA500]

Seems like a fairly simple scam. All you would need is an email thread with relevant invoices and you would be well on the way. Surprised all the money was recovered after the fact though?