Ok - cracked it....
I purchased 92,000 points for my IHG account on the 13th Oct.
Miles&More number matches the IHG account number (as in the number within the email is my IHG number).
I think this might be a points.com issue and sadly I do not have a Miles&More account. I don't know how this could be linked to a data breach though?
Very strange....