I was told the "ph" comes from the expression "Password Harvesting", which is what apparently they aim to do with these e-mails. I haven't confirmed it, though... does anyone know for sure?