greengoblin,

On my list of NO1s I would include any party that would suggest to anybody - especially those who might not be experienced with pc and internet use - that they use an email address to send them the same stuff which they can easily just download off this site directly. Somethin's either fishy or just not real swift there.

I'd consider clembob101's method only if I damned well knew the perp wasn't connected to bigger heav's.

Rasta's probably got best overall remedy, cut losses and be more careful next time who you trust.

Do not voluntarily send evidence of your grow or any authorization via any email addy that is not designated as SSL secure.