The IRS is using a system that was hacked to protect victims of a hack—and it was just hacked