A second account was compromised via brute-force password guessing.  I’m working on getting fail to ban configured on the mail server (and later other servers) to stop this.