Thousands of university students and employees targeted by email phishing schemes this year have taken the bait. Fortunately, they were duped not by real scammers, but by their own schools—in simulations meant to make them more adept at spotting real threats.