This happens even in the best families. Yesterday Outlook365 informed me that there's a suspicious and blocked message coming from Github. And yep, that was the email confirmation I should've received from the real Github. I would assume that whitelisting bought services could be a thing within Microsoft...