It seems much more likely that users creating accounts for phishing purposes created multiple accounts. In that case, nearly 10% of accounts ≠ nearly 10% of users.