The sophisticated scam involved a tiny email alteration and fraudsters hacking an assistant to the city manager’s email.