As stupid as it sounds, people fall for these scams all the time. Most employees are not supposed to use their work computers for personal things and especially on the clock. But, most people do and no one says anything. Most employers have you sign an agreement of workplace internet rules, computer usage and some sort of phrase that says an employee found violating these rules could be grounds for termination (or prosecution) depending on the situation. Look how many older victims lose thousands of dollars if not their entire life savings based on scams. Scary and sad how easily even "smart" people are fooled into these scams. I'm sure this employee had some very unpleasant meetings with University higher ups and Human Resources. Then they send out an email warning all employees of the latest scam & to report suspicious any emails. The article didn't say what capacity this employee had, it could easily be a part time student. Depending on the malware even a limited access could work.