A business email compromise (BEC) scam that cost a Sydney hospital $2 million has led to the man behind it being charged.