Missing the point

I recently got an email security alert from YU warning about a scam:

Hello:  This is yet another bogus email making the rounds at YU.
PLEASE NOT click on any links!   Please delete it.
If you have in fact responded to this email, please contact the Held [sic] Desk!
A copy of the email is below:
[snip]

This seems pretty straightforward.  And yet, a few minutes later, someone responded, to the entire YU-Infosecurity mailing list, with their email user name, password, etc.  Sometimes it is important to read instructions, you know.