Thanks for the input everyone. Pulled AdSense for search and in the process of pulling the rest of click and impression ads to be replaced by sale based advertisements. Fired off an additional report of fraudulent clicks. Working to weed down the several GB's of logs over that date range to try to identify the offending IP address(es). Email was sent from Algeria. Extortion demand was to send money to Algeria. I seem to doubt that either local or federal authorities would be interested.