Verifying an address is two checks that together close the phishing hole. Neither takes more than a few seconds.
The signed pool
Awazon publishes its mirror set with a PGP signature. Verifying that signature against the market key proves the addresses came from the market and nobody edited them. Fetch the key once from two independent places, cross-check the fingerprint, and import it. See verifying a PGP signature.
The captcha check
When you reach the login, the captcha prints the market's own address. Compare it, character by character where it counts, against the address in your bar. Match means genuine. Mismatch means clone.
Why both
The signature proves where a published list came from. The captcha check proves the specific address you are on right now is the market's own. Running both catches more than either alone.