Upon arrival at the site, it was noted that the client had already changed the email password and enabled 2FA. Virus scan was performed on the computer and POP was disabled as required.