At 7:12 a. m. on a random Tuesday in February, an email lands with a subject line that looks harmless enough: “Your tax forms are ready