Crooks are abusing misconfigurations to trick victims into thinking they received an email from their bosses and HRs.