Let me preface this with, anything is possible
But if your client folowed the link to pay your invoice from the email received it is no more likely than if they ordered online from Amazon.
Chances are their data was compromised in some other fashion that does not readily pop to mind
