A credential-theft clue can be more than malware noise, especially when investigators use it to map a possible email-fraud path around a named maritime company.