Rui Pinto, a Portuguese hacker, spoofed a UEFA email in January 2017 and got a City official to click. One click. That breach handed him thousands of emails and internal documents. Almost a decade later, the Premier League's independent panel just found Manchester City guilty of nearly all charges against them. The Athletic broke the story Friday. One phishing email. Ten years of fallout.