Is that email *really* from payroll? The bug enables spoofing that slips past spam filters and doesn't trip Gmail alerts.