[frodopwns]

This same thing happened at CU Boulder. The phishing attempts take the form of an email from IT stating that the user has exceeded their max email capacity. The letter then tells the user to forward their credentials to the mailer.

It is sad that people can't learn to keep their passwords to themselves.