It would seem that someone has managed to obtain a list of e-mail addresses hosted by PlusNET somehow and is exploiting them to send SPAM with malicious links. The e-mails appear to be being sent from compromised servers other than PlusNET, but by substituting the actual source address with the obtained PlusNET addresses (known a s spoofing), it has been made to appear to the target that the message came from a PlusNET account, when, in fact, it did not. Unfortunately, any messages that "bounce" or any replies returned will come back to the plus.net address in the reply-to field, so we, PlusNET e-mail account holders, rather than the spammer, end up getting the SPAM as well as delivery failed messages from non-existent target addresses. Meanwhile, the spammer collects personal details and data from anyone inattentive or foolish enough to click the links in the body of the message via a fake web server.
Of course, the recipient will often assume the e-mail came from the spoofed address that they can see in the From: header, so if they happen to vent their anger, then it ends up being at the perceived sender, who, of course, is totally innocent and unaware (until that point) that someone is misusing their e-mail address.
The frustrating result is the the company, its clients and recipients of the SPAM messages are all inconvenienced, while the spammers continue their nefarious activity. The number of people clicking links in SPAM mail is still quite high (around the 30% mark I believe) making it sufficiently viable for spammers to engage in such activity.
It cannot be emphasised enough that if you receive such an e-mail DO NOT CLICK ON ANY LINKS.
