An online phishing simulation at a Connecticut dealership group reveals a disconcerting result: A fair number of employees aren’t as wary as they should be about emails — especially if those emails look authentic.