I just received an email claiming to be from firstname.lastname@example.org , with an attachment.
Yes, my anti-virus program found a nasty in the attachment.
This is a reminder: It is very easy to put a “return address” sticker one email. I’ve done it myself. I use it to send “thank you for your comment” messages from “email@example.com”. I know of three very different ways to do it.
To repeat: Just because it says, “From Hallmark” doesn’t mean it really is.