The once popular Outlook add-in AgreeTo was turned into a powerful phishing kit after the developer abandoned the project.