UPDATE: In case anyone is interested, we upgraded our customer's site last night from 13.5 (which was red flagged as "DECEPTIVE" by Google (in the "social engineering" sub-category), to 15.7.x. We then requested a rescan of the site and they cleared the flag.
We had previously:
- turned off "password recovery" which removed the FORGOT PASSWORD link (and the associated javascript) from the login page
- forced SSL for all webmail traffic through a modification to the web.config file
- scanned the entire server for malware
- manually inspected the files in the SM webroot and /scripts folders for any new or changed files
- ran the SM web URL through external scanners (such as quttera.com, sucuri.net and aw-snap - all clean)
The only thing that solved the problem was getting off of 13.x. If you are in a position to do so, that may be your only option, unless SM can figure out what is tripping this particular Google alarm in the 13.x code and providing a hotfix file of some kind. 13.x, I imagine, is no longer officially supported, so I don't know of any other recourse for you. And Google did not disclose any specifics about what code on the site it read as "deceptive". Lastly, let's hope that Google doesn't suddenly find something in 15.x or 16.x it deems as dangerous.