Glad to help. spoof@paypal.com is their fraud unit. By forwarding the email to them they may be able to track where it came from.