whois 65.74.181.132 shows that they ssh'd into the webserver from another machine on hbgary's network, perhaps the mailserver. I believe it's really easy to do

whois 65.74.181.132 shows that they ssh'd into the webserver from another machine on hbgary's network, perhaps the mailserver. I believe it's really easy to do email MITM when you have a login to the mailserver or own a machine on the same subnet and put its NIC into promiscuous mode.