Robinhood fixed an account-creation flaw that hackers abused to send convincing phishing emails from its own system to some users over the weekend.