Probably because all the competent employees reported the first email as phishing. The only box it didn't check was asking the employee to buy and Amazon gift card.