My first guess would have been a virus or malware from openning up the attachments.
I know DH had one in his company ... it was an email about an error with a wire transfer from nacha.org. Now, nacha is a legitimate wire transfer company but they work between banks, they do not deal with the public. Anyhow, someone had just returned from the bank having sent a wire transfer, and they clicked on the attachment, releasing malware onto their system.
Now chances are the email would look fishy to most (Especially if you don't send bank wires) but to someone who fits the target mold, there is a reasonable chance that the email looks legit, and they will execute the attachment or get duped in a scam.
If enought emails are sent out ....someone gets hooked. I got one this morning from HP Scan Center, sayign there was an error with a scanned document and the instructions for resetting the copier are in the attachment. Now, we don't have an HP (we have a Toshiba) but if we did and I was the office administrator, the email might have looked legit to me.