At 7:12 a.m. on a random Tuesday in February, an email lands with a subject line that looks harmless enough: “Your tax forms are ready.