[davidscoville]

I lost the original email—the attacker deleted all evidence and then cleared my trash (and yes I tried using the Google tool to find deleted emails, but the attacker cleared that too). The reason I have this email is because I forwarded this email on to [e-mail], before the attacker deleted everything. When I got control of my account, and removed the scammer recovery methods (he added a windows device—I don’t use windows, and a Brazil phone number), the email bounced back from [e-mail] (apparently Google doesn’t accept that address). So what I have is the bounced-back copy.

[davidscoville]

I updated the post and include the headers & html of the bounced-copy, although I don't think it's very useful.

[cpncrunch]

I'm not seeing the headers anywhere in the post.

[cpncrunch]

Ok, I see them now...for some reason it took a while for the article to be updated.