So maybe she emails the museum and says "pick it up." And then a week later a guy shows up on her doorstep and says "I'm here to pick it up." How does she know the guy really works for the museum and is not some criminal who hacked into her email? She's never met him, and he's not going to be carrying an FBI badge after all. If she gives the bust to the wrong guy, maybe the museum sues her because it was their property in the first place.
There are well-established legal procedures to deal with matters like identity verification, and lawyers can handle them. That's one reason why she needs a lawyer.
I'm not saying that an email hack is far-fetched, I'm saying that worrying about this specific consequence of an email hack, while otherwise not worrying about an email hack, is far-fetched. It's like refusing to go to a specific store because you're worried your car engine will catch fire. If you have bigger problems, deal with those first! Don't use them as an excuse while not trying to fix them or take them seriously in any other way.
I’d be damned if I were going to pay for a lawyer because of a $35 goodwill thing. Ancient Roman art or no. I can totally see why people just keep it on the mantelpiece.
