I agree the example they give seems a bit unlikely especially since the subject line is not changing (though admittedly I do not have experience in this area).

I agree the example they give seems a bit unlikely especially since the subject line is not changing (though admittedly I do not have experience in this area). However something a little more subtle such as swapping out a routing number from a legitimate to an illegitimate one could be done and that seems harder to catch especially if the person who forwarded it to you is supposed to verify it first.