How did Yahoo get breached? Employee got spear phished, FBI suggests