Respectfully disagree.  "This incident is not the result of using an overseas or any third party vendor.", I'm not certain you have facts/evidence in hand to support such an assertion.

" a social engineered hack via email.", not sure, that's the right term to describe it, but more importantly, where and how did the perpetrator learned about the title company and its communication with one of its customers (the victim in this case)?  Two roots, the title company and the victim him/her self.

Second, on the technical level, were I the law firm hired by the victim, I would examine the FULL header of that damaging email (fake email from the title company), there are two types of unauthentic email, one is that the email system has been hijacked and the other utilized an Internet protocol (seasoned Internet engineers would know), and both can be tracked.