You found it. They clicked on something in email.
There are too many bad things in emails or malware or more to the point RANSOMEWARE that will encrypt your docs and demand payment.
If they click on attachments then they may only learn this the hard way. There is no single cause or cure.
Here's a video on a recent SCAM.