Hi Mike
A friend of mine unfortunately had a similar case with a Chinese partner firm.
The
e-mail correspondence was intercepted - I suspected a trojan in the
Chinese firm (or simply an employee of that Chinese firm going rogue,
who knows...).
The forged mail was exactly as you describe it: The second e-mail stated, that the bank account information was changed.
However
in this case the forged mail clearly came from another e-mail, but it
looked very close to the one from the Chinese partner. Unfortunately my
friend didn't see it.
He asked me to help investigate this as
his e-mail account runs on a server I manage and from the mail logs I
could show him that the forged mail came from another sender.
Take
a look at the mail headers and mail logs of the recipient server (if
you can) to verify where the fraud mail came from. Compare the sending
servers, the e-mail address itself can be easily changed as you may
know.
I am at this moment not aware of the current status
of that case but I know police investigation (and also investigations on
my friends Swiss bank) were ongoing.