City changed vendor bank account info multiple times, solely based on email requests – without conducting basic verification. City promises to do basics in the future.