$10,000 is a lot. Maybe make real but effectively no-op customizations to each legit copy so each is unique, including a banner that says whose copy it is. If it later shows up stolen you know whom to sue. Add some phone-home statistics and you know how much to sue them for. Do a little runtime checking on the visible ID banner to make hard to remove.

The pointed to Phishing IQ Test is, at least to my ideas, bogus.

I identify phishing e-mail by looking at headers, link URLs, etc.

The test e-mails were screen shots where URLs were dead and headers were missing.

-kb