In proof that ANYONE can be tricked by a good phishing scam, Troy Hunt runs Have I Been Pwned!! He’s reporting his own mistake. Which is amazing. The write up is worth a read if you care about password security.
https://infosec.exchange/@haveibeenpwned/114223440143323138