This sounds more like social engineering to me. My first thought was this was a hacker who took control of an email address from the security firm, and just tried to exploit the weakest link in order to get plaintext passwords.