I figured it was a phishing thing sturm. I did send it to earthlink abuse and ask them. They haven't answered but, I think you are right