The attacker can also use the compromised account to message or email colleagues with additional phishing messages.