2 step verification/authentication, for example, could prevent something like this.
Their system is vulnerable to phishing attacks.
This is something IT security will have to deal with because this is a flaw in their system. A more secure system would have measures put in place to prevent such basic phishing attacks.
Just because it's not some computer science nerd writing a script to infiltrate their system doesn't mean it's not a hack.
Not everything is like you see it in the movies.
This message has not been approved by The Office of The Mayor of Toronto.