On the phishing simulations, remove the from hacware.com that sometimes appears by the sender's email