Documents reveal that USAID was victimized by a password spray attack that resulted in roughly $500,000 in Microsoft service charges.