A flaw in the online trading platform’s account creation process allowed attackers to send convincing phishing emails.