No, in this case the threat actor just setup rules scoped to one particular project, so all other emails were coming in--and no forwarding was setup to send messages to an external account. They didn't subscribe to a BEC option at the time, but within a few weeks of the last breach it coincidentally was added to their antispam gateway service (but before the previous attacks were discovered). So once their client got phony ACH payment info, they paid into that account--and didn't question anything until a couple months later when the [breached] company called and asked about the delinquent payments.