That's expected, and the attacker rented an Australian server to proxy as close to my geographical location so it won't raise alarms with email recoveries. Wouldn't you think if it was an inside job, I'd use another IP?