The threat of phishing and other email attacks continues to rise - so why aren't businesses training employees to recognise attacks?