Good news: was not a hack but a cheesy new account impersonation attempt. Still troubling but not a hack, per se.