In my time as a cybersecurity professional, my approach is always to blame the system, not the person.

If they clicked on a phishing link: 1) that email should never have reached their inbox, 2) that link should never have loaded, and 3) our awareness training is not up to snuff.

Unfortunately, lemmy.ml is run by lemmy’s actual developers and will likely remain one of the most popular instances. Best thing to do is block the instance and host new communities on other instances.