Actually what clued me in that the spoof phishing Paypal attack was bogus, is that nobody gets my actual email address.
I have a paid subscription to www.Sneakemail.com which allows me to create a unique email address for each new contact.
They only see that, not my real email address.