This happens all the time, it's nothing special. Normally targeting known btc users, using emails from leaked DBs (eg. gox)