Open redirect on UK council website was being used for Royal Mail-themed parcel payments scam