Even the X account could have been compromised... this brings up the interesting question as to how to confirm a payment address is the legitimate one and how the funds are being used as per the expectations of the donor. I've heard this from many in a simple situation of some give to the homeless, while some won't because they are not sure if they will use it for drugs or what the donor decided was not good use of it. Whatever the reason, we have been with this issue now for a long time.