Yep, thanks -- got directed to this thread. Our spam team was already on it. It is spam, not malware. No one is infected with anything. I think things are already improving and they'll keep debugging it.

I'm affected and Danny's been in contact. Thanks!