An unauthorized third party had gained access to a Sandbox employee's computer and used it to send a false email to users.