Whenever I get an email like this I immediately look at the original source and headers. Always look at the HREF addresses hidden in the message body.