Phishing bug leaves 400 million email users at risk