The attacker could have intercepted the email somewhere between OVH and the recipient unless the SMTP session was using SSL (which, unfortunately, isn't always

The attacker could have intercepted the email somewhere between OVH and the recipient unless the SMTP session was using SSL (which, unfortunately, isn't always the case). Obviously this is highly speculative.