More than half of those who got a phishy email and about 40% of Facebook users clicked on a link from an unknown sender that could have been crawling with malware, for all they knew.