Spoof e-mail to call 1800flowers.com

[1o1]

I am trying to find out who could send this spoof e-mail.

A week ago I received an e-mail message about activity on my PayPal account, which was delivered into my Gmail account. It reported that I added a phone number (which I didn't), and listed a customer service phone number to call, a number which belongs to 1800flowers.com. There were no fake links in the message, all links pointed to PayPal pages.

According to Google, the message passed security checks, and was received from PayPal mail server.

Could security headers be forged? Or is this message really sent from PayPal mail server.

Did someone received a similar message?

I forwarded the message to spoof@paypal.com, and received back two template responses. The first one immediately, thanking for the submission, and the second one later on the same day, thanking for reporting a fake website. Since those were template responses, it is not clear if something was found in this particular case. According to the responses, the investigation is ongoing.