40M users doesn't really give a good idea of how significant 3 complaints are. Still it sounds like some additional screening and protection against phishing needs to be implemented on Zoho's side.