"In order to hack an email from the sever they'd almost have to be monitoring it at the exact second it came in, modified it, sent it, then sent a different reply back...."
You're getting closer. Except for the last part. The reply back is automatic since it has already been altered.
But listen. I am not trying to convince anyone here. I am more concerned about my friend. The insertion was not inflammatory in the sense that noone outside of the sender and the receiver would read it and understand that it was a problem.