Re: I'm gonna go out on a limb here....
Very rarely is docm actually successful nowadays, it's usually "encrypted/protected documents/PDFs" that ask you to sign in. Likely for the ol' Twit they probably sent out fake account alerts that sent to a fake login page.