That's why every one should learn how to read a message's source text, Thunderbird has that under "View" as well as keep track of their transactions and learn to recognise fake from real and don't act too fast to "see what is wrong". You should have the real e-mailed transaction notices saved to compare, then delete the fakes.

EDIT:...and goes without saying, always use MalwareBytes on a routine basis.