"I remembered the notification from YouTube that someone had accessed my account from a different location – a notification I had ignored, assuming that I had logged in on a mobile device or that my husband had accidentally logged into my account instead of his own."

All of her accounts were compromised - seems more likely to be malware than social engineering.

Also the hosts you mentioned use in-house support.