Really, it was simply your mistake for following a link in an email and then entering credentials where you landed, i.e.. you fell for phishing. The idea that

Really, it was simply your mistake for following a link in an email and then entering credentials where you landed, i.e.. you fell for phishing. The idea that a company should only accept one account per email address is bullshit (it a contact address, not an identity), and if they don't do that, any of that "don't allow any aliases for email addresses" on the part of the email provider would be completely pointless anyway. You simply don't use context delivered by email as a starting point for disclosing credentials, and you have solved all (email) phishing attacks.