UK students are at risk from email scams because many top universities are not following best practices to block fraudulent emails, new research has claimed.