So, I finally got my love letter. I had logged in last night for the first time in awhile. I’m thinking that may have been the connection. When I got the email, I immediately went in and changed my password.
Who knows if the perpetrator has access to individual accounts. My suggestion is to not only change your passwords, but scour your account, inbox, etc., for any other RW info. That may be overkill (after all, if they really had anything more than your ID and email address associated with the account, wouldn’t they include at least some of that in the blackmail threat?), but better safe than sorry.
Fortunately, if they got into my account they don’t have any useful information beyond my hobby phone number, and I already used a distinct password that isn’t associated with any other account. Unless someone reports they’ve had some followup communication from the bad guys, I’m guessing this is just a feeble hit and run attempt.