BEC attacks that use compromised mailboxes are especially dangerous. Here’s how we learned to identify them.