

The reason you didnt list, but is the most likely answer in my experience - by spamming the user who was compromised, they will miss the orders placed using their account info, or the password reset, or other such emails.
You aren’t the target so much as the distraction tool for their other efforts.
She’d just tell him to go first.