I don't understand what happened....sorry to butt in, but
I recently started escrowing accounts for people on microloans
and want to make sure this doesn't happen to me.

You set the email address to something "random" and someone
just guessed it?  Or what?  How was it hacked?