Cybercrooks book a stay in hotel email inboxes to trick staff into spilling credentials