it doesn't feel that scary to me -- it essentially took 5 mistakes to hit the payload. That'd a pretty wide berth as far as phishing attacks go.