There's one really easy step you could take that would make a huge dent in those phishing schemes:

Detect and block phishing emails that are forwarded through your service. Right now, I get several messages forwarded per day from "Sam at Mailgun" (actually a variety of external senders) trying to get me to log in to review various (nonexistent) problems with my account.