Oh yes, I can just hear the various defenses :
- using MS, which is hopelessly vulnerable despite endless patches
- uses Outlook, 'nuff said
- firewall absent or incorrectly configured
- bla bla bla
This could actually be an interesting case study, if the "experts" are up to snuff, that is.
Indeed, a forensic analysis can no doubt reveal many things, and this might be an excellent chance to find out just what can be found.
I hope this is not settled out of court, I'd like to follow it and see where it goes.