To be clear, everything is fine. The trainees who were taking the mock calls were instructed to not actually change any passwords, so no credentials were disclosed or modified. The issue only escalated because the trainee put the CEO as the caller in the ticket, which sends an email notification.