Army commanders who want to run phishing simulations on their staffs will now have to get approval first, after an email phishing test went awry last month, prompting a small group of recipients to forward the email to thousands of government coworkers.