Hello Cue!

Thank you for the question. Allow us to explain.

The email you received is an attempt at phishing, as you have likely read in our blog post. However, what you are seeing (the email address and its source) is an act of spoofing. Spoofing an email address will do precisely what you are experiencing: the email will look legitimate and sent from a trusted source, when in reality it is not.

Typically an email can get spoofed like that if you have an unprotected form on your website, or if there is an email address in plain view on a page. If that is the case then we recommend securing your form via CAPTCHA and removing any plainly visible email addresses.

We checked to see if your website itself was hosted with us (despite your domain being with Bluehost as you mentioned), since we would have been able to help you with this. However, as that is not the case we cannot provide you with more in-depth assistance.