[lesuorac]

It would be nice if the article had additional details.

Did the email come from within their own domain? Like a properly set-up domain isn't going to let you spoof their employees so your emails to the CEO will be authoritative since they came from the correct domain (assume your CEO checks its ycombinator.com and not ycombimator.com).

At 4k though I suspect it's not that worthy of a target when you can do the same effort to net 25 million. Although I'm a bit surprised there isn't some internal page to add/remove the hardware requests so that it can be easily accounted for by accounting.