I am surprised that such an in-depth discussion of a phisihng campaign doesn't mention DMARC as a solution for domain owners to stop abuse of their domain and brand. The answer to "how could a phishing campaign last so long" is quite simply: beacuse it works! DMARC is fast becoming the solution to this problem and can stop the problem at the core, as you have correctly pointed out, the email that starts it all. Please take a look at DMARC.org and Agari as we help eliminate malicious email and brand abuse from the Internet.