Chiming in with barely any knowledge on the topic.
Universities are massive institutions, with serious cash behind them. What the hell is stopping, say, all the public Australian universities just setting up their own journal, running it at cost for all the universities in Australia?
Make it make sense.
Honestly, good on you so much for sharing. The fact you’re not ashamed and willing to share could save someone from the same attack, and as others have pointed out, even the most security minded of us can have lapses in judgement.
I’m really glad you weren’t screwed in the end.