An apparent business email compromise scam stole $4 million in rental assistance and transitional housing funds from Lexington.