Seems I was hacked. I did purchase LR5 directly from them. Interestingly enough, the credit card I used had fraudulant usage reported on it back in early October and has since been cancelled and a new number issued. No way of knowing if this was the cause (another interesting coincidence was that the fraud was reported within hours after eating at the same restaurant we ate at the previous time our number was stolen - though we've also eaten there several times withouth incident, but will be paying cash from now on).