It was a seemingly innocuous email, sent on a Wednesday morning in January 2017, that started everything. Arriving in the inbox of a senior official at Manchester City, it appeared to have been sent by an employee from European football’s governing body, UEFA, and contained a link to a financial compliance report. The City official clicked the download button. That was all it took. It was not a genuine email from UEFA but a successful phishing attempt by Portuguese hacker and activist Rui Pinto. City’s servers were breached, allowing Pinto to retrieve thousands of emails and documents from the club’s systems. This week, almost 10 years on from Pinto’s first email, the Premier League announced that an independent panel had found City guilty of all but one of the charges against them, as The Athletic first revealed last Friday. 📝 @jwhitey98: nyti.ms/4z5sgoL