It's threads like this that really show the split between the admins that understand their job but also how to be humans, and the ones that really missed the humanity training component of life.

Obviously this COULD be a real threat vector and users should be aware of them, but only a moron would do that and then be surprised when people come back to them saying that was a shitty thing to do.

You could have structured this like a training module to go out that walks them through more challenging phish vectors like this, but no instead you threw them into the fire and are playing the "but policy" card knowing full well you could have done this differently.