Check their PCs to see if they have mysterious proxy server settings, or DNS entries that look wrong. Either might have been hijacked.