Chipotle, the giant Mexican fast food restaurant chain, was sending emails to new job applicants from a domain - chipotlehr.com - it didn't own. What could go wrong?