Criminals are exploiting firms’ use of online feedback methods to distribute spam and phishing emails, security researchers warn