If Marriott doesn't buy it, what if scammers do and send emails asking for people to go to a bonvoy.com link to "reset" their password thus giving up unauthorized access to their account accidentally.