Cybercriminals are abusing a legitimate Mimecast feature to deliver convincing phishing emails to their victims - at scale.