Then came the final discovery.

A forensic examiner found that the suspicious corporate authorization had been created using information from an old family document folder.