A 'simple' DNS attack would get them access to the mail servers too. There are plenty of CAs out there who will give out a (non-EV) cert to anyone who can rece

A 'simple' DNS attack would get them access to the mail servers too. There are plenty of CAs out there who will give out a (non-EV) cert to anyone who can receive emails to webmaster@example.com.