The email arrives at 11pm on a Sunday. Subject line: "URGENT: I think my website has been hacked!!!"