Thanks for alerting us.
They are getting incredibly inventive and sophisticated. I saw on NextDoor a member of a local church near me warning about a scam where someone got a hold of their church directory, extracted the phone numbers and then sent out a text from "the pastor" asking for gift cards for a member of the church who was sick and facing financial hardship.
When scammers start taking full advantage of AI tools in the next year or two, it is going to be out of control. I think your lockdown of emails (that would seem like an over-reaction before) is a prudent move. I think companies will need to put in place decision tree type tools for request to change phone numbers, emails etc. Like, "Did the request originate from an existing email?...If not, did you call a known phone number to confirm the request was legit.
Oh, and no church should have their member directory online. Hard no!