Thanks for starting this thread, as I was also totally confused and thought it was phishing. Anyway, I'll add a data point. My email had my Radisson Rewards (non-Americas) number in the M&M field. I don't have a Miles & More account.

I didn't purchase any points, but I did transfer points from Radisson Rewards to Radisson Rewards America. The amount shown was one of several transactions I made. Edited to add that the transaction number in the email matches that points.com transfer transaction. Stellar points.com IT.