that's quite a lot of steps involving multiple people, likely to get caught and lead to real world consequences even if after the fact, at least it would destroy @jb55's reputation forever very different from one employee from the homeserver hosting provider being tricked into giving access to the account of an important person to some malicious entity like we have seen happen many times in every big platform