I'm going to try my best here as his is still a bit new to me:

Here is what happened. Client get's a new website. Goes to the server and creates new e-mail accounts for himself. He sets the password to something simple like "Dog" (over simplifying it here) He now has hiswebsite.com/webmail to access his e-mail accounts.

Someone found out he was using webmail and brute forced their way into his account since Webmail doesn't appear to have any type of "3 attempts and you're locked out". Once they had the password. He they went to Gmail and setup a new account with the credentials.

The way they did it was by setting up the "inbount" account first and selected the option to import all e-mail and not to leave future copies on hiswebsite.com/webmail account. Gmail doesn't notify the user that someone setup a new e-mail to take in the inbox.

Next, they setup the outbound. Gmail notifies the user that someone is trying to send mail using their e-mail and to please type the Pin Number that was e-mailed to the primary account. This pin number should have gone to hiswebsite.com/webmail but instead, it went to the newly setup Gmail account box. The attacker verified the pin number and then returned to the "inbound account settings" he edited the settings and selected the "Leave e-mail copy on the server".

Once all of this was done, our client had no idea that Gmail was literally copying the e-mails to someone else's account. He only found out after someone brought up to his attention that they were receiving e-mails from "my client" trying to get information from his clients using his e-mail account.

--- all of this could have been avoided by following basic security protocols on my client's behalf, but at the same time, I think Gmail should send out pin numbers when you're trying to setup a new account - Inbound or Outbound.

Granted, now that I'm thinking more about it, If they had his password, they could very easily erased the e-mail anyway so it doesn't have much of an effect anyway :/