You Designed Your Security Service Like A Phishing Campaign?

from here and here

I wonder if Hold Security understand how many ways they've done their identity compromise discovery service wrong.