We got hit by an alarmingly well-prepared phish spammer