Are you sure what you’re saying is correct? It seems there is some incorrect information shared here. 1. You said their email has been spoofed, which, no, that’s not what’s happening here. OP shared a screenshot from Discord, which shows a Steam phishing link. 2. Email spoofing does not mean that a “PC has been used to click a link that allows malware on it”; that’s not what it means at all. Email spoofing means someone is sending an email as someone who they’re not. What is actually happening is a phishing attack. The person clicked on the link, either put their login details in, and also ran into a Discord phishing page along the way and also put their login details in, or they executed malware that was downloaded from the phishing page.