I would differentiate SPAM and SCAM here, the best thing to do is go directly to aa and check that you can log in. Check to make sure no one has tried to change the email address on your account I personally would also change my password