Is it obvious how stuff like this is a good surface for spear phishing if done incorrectly?