The San Diego State University team uncovered nearly a million dollars were scammed from victims via the Lists feature on Twitter — now called X.