The following story came from a friend of mine, it is another example of what can happen when an email system is compromised.
A business owner is regularly in contact with their accountant. There are invoices which need to be paid, are regularly passed between the two parties. One day the accountant calls the business owner to check on an email they received which looked like a copy of another one. Both carried invoices. It was a sanity check.
It turns out that the second copy of the email carried a modified invoice with a different account on it. So someone had infiltrated an email system somewhere between the two parties and was now trying to commit fraud by inserting their bank account into the transactions between the two parties.
It was only through the vigilance of the accountant in this case was it spotted.
How is it done?
Very often it is simply achieved by tricking someone to click on a link in an email which takes them to a seemingly official website and inviting them to log in. If they log in with their email address and password, that information is passed to a third party. Now the third party can get into the person’s account. It is quite possible that if they do this passively the person who has their email account compromised may be unaware of it.
Change your passwords regularly.