do you still have the emails? might be worth examining the headers to see if it was some kind of phishing attempt.