Paul,
I'm not too adept at gleaning pertinent info from these things, but both 'from' addresses seemed to be from PayPal (Update0zfs4e02x@paypal.com was one) and they seemed to have come through compuserve somehow.
My brother got some last week with a link that took him to a form. Mine had the form built right into the Email text and included PayPal Logos
The form seemed to execute something at:
paypal.com-(some zillion digit # here 0100101011100 etc)-@gratelol.port5.com/(0100101011100 ...).php
Here's the (disabled)
Email Bill
