Cool cool, definitely not criticising, and a great article to post
I think the weakness of the article was mentioning that the email passed the Security Policy Framework (i.e. appeared to legitimately be from x.com) without discussing why this is possible and who is responsible for it not happening
They even say in bold that ‘the primary responsibility less with the end user’, but in this case even careful users could easily be caught