A fired agency’s leftover admin access injected a foreign address into Google Ads, collapsing local traffic and calls. Here’s exactly what happened and the checklist to prevent it.