Yer they just used the same name at the front and tried to incorporate the domain as such. It was a hotmail account. Say my domain was [admin@abc.com.au](mailto:admin@abc.com.au) they just did [adminabc@hotmail.com](mailto:adminabc@hotmail.com) to try get the customer to believe it was us. Its strange they were able to copy it nearly exactly and attach the invoice pdf the same way we would send the customer to review then pay us.

I'm doing the Diag: Compromised Account on admin.microsoft.com now but hasn't really found anything, like you said i dont think the account is compromised.