Did you receive the email in a similar time window? I'm trying to think of ways to scan other repositories for signs of compromise.