I'm not sure how easy or practical this would be, bit one way I can see this done is if a user creates a phishing link hidden in the post which will redirect to a fake forum log in page. If a users clicks on a link deliberately to take them there, they would be fairly certain it's a phishing link, but if they do not do so and just get redirected, that could be mistaken as a forum pop up which wants to confirm their password.

Regular members should easily spot this, but I wouldn't know for those who've not been here for a while.