Company's autodiscover caused users' test credentials to be sent outside Microsoft networks.
Abusing Microsoft's reputation may make scam harder to spot.