The URI scheme is composed like so:
As you can see, the
@ is used to include (in this case, HTTP) authentication directly in the url. The question then becomes "Why would a url that includes authentication be a sign of phishing?".
I don't know the author's reasoning, but the most common argument I've seen is that it's an easy way to confuse the user about what the domain is. For example,
http://www.mozilla.org&login3:firstname.lastname@example.org/evil looks very much like it's loading
www.mozilla.org, but if you look close enough it's actually
example.com/evil. Tricking the user into trusting a false website is the core of a phishing attack, so this provides a really nice attack opportunity for a phisher.