I take your point, but my issue is more with the fact that I can point to the recipient email address of the email and make a pretty good case that my name, add

I take your point, but my issue is more with the fact that I can point to the recipient email address of the email and make a pretty good case that my name, address and email address all originated from iFit, either by them selling my data, or by their systems being breached. Another user also pointed out that the fake invoice was for exercise equipment - the same general category as iFit. I don't think that is a coincidence.