It seems like “the subject clicked a link in an email” is equated to “being phished”, but I’m not certain that is a good definition.
It could be kinda-secure if the header had to have a payload which matched a certain value pre-approved for a time-period. However an insider threat could see the test going on and then launch their own campaign during the validity window.