If the people running this actually cared about phishing, they would update their email system to put a giant red header at the top of all emails coming from an external source.