Thanks for that link. These three all came in within about an hour.

I use "Spamgourmet" for signing up for sites that I am not sure about, and used one of their disposable address when I joined here in 2006 which is then forwarded to my protected address. It would not be guessable! Absolutely nothing other than proper FT stuff has ever come in since then until today. Each mail that comes into the address is copy numbered and these were sequential. Nothing before and nothing since. Mail only ever arrives from FT as I don't use it for sending anything back - hence why I know it is a one way thing.

The emails are identical in content and with a zip file payload, with the exception of name change within the text to reflect the email address that it appears to be spoofed from, which are each different addresses.

I take no issue with IB taking this sort of thing seriously as mentioned in the other thread, hence my notification as I thought it so unusual and something they would want to examine.