A user clicked a fake email link and entered her password. Contain the incident: the account, the sessions, and what the attacker did in the mailbox.
Medium and hard labs are for subscribers. Subscribe with one payment and no automatic renewal, or practice on the easy labs for free.