It was hacked by at least 6 different operators.
The malware that forwarded emails is only one of the six compromises.
Forwarding emails is not how one would "sell access" although it's totally possible she is that dumb. NSA would of course EASILY pick up the forwarded comms.