cecelia wrote:should people who have logged in with the union client reset passwords and stop using it?
From what I was able to gather, these guys were using a client over a year ago which was collecting passwords (at the time, I think the name "Rizen client" was mentioned; I don't know whether or how it relates to the Union client) and was involved in the time I nuked AD. Their accounts were stolen in this way, but they never switched their email addresses back, and were now taken again with a password-reset-email to the hacker's still lingering e-mail address. It is partly their own fault for not securing their e-mail address after their accounts were taken, in other words; which is part of the reason I'm not going to try and give their items back or anything (part of the reason, mind you).
That, of course, doesn't excuse the hacker himself. I'm awfully glad I was able to track him down this time.