This is happening when a buyer and some cases vendors are creating accounts on Atlantis via the phishing link with the same credentials as their SR account. This then leads to their SR accounts being hacked, any orders in transit finalized and the feedback you see with the Atlantis phishing link included. There are even some vendors listings now up with the phishing link, if you see it please report it so the admin can deal with it.