Attackers didn't just read mailboxes — they stole the zimbraAuthTokenKey that signs user session tokens platform-wide, ...