Corporate phishing tests are common, but this one was especially cruel.