A bizarre email security flaw is causing companies to send sensitive information to domains that outsiders can register, as per a new report.