Long story short: My boss passed me logs and informed me of the situation. After the last impersonation incident (for those of you who remember buyvm.com), we simply have zero tolerance for this mess. Add in the malware on top of that? Absolutely not, termination and refund it was.