[joezydeco]

Seems more likely it was the client. If the OP was hacked, the thief could have sent a completely legit email with correct headers and etc.