Beyond the Inbox: Quantifying the Cost of Weak Email Security