In-depth report: How cybercriminals are using email account takeover