oof that is 100% a suspicious email though, and *exactly* the kind of thing that leads to account takeovers. Even better than sending a PR doc in an email would be to send a link to a website that requires a password. The browser is way safer than downloading anything.
Definitely a campfire smell, but at this point I could just be desensitized to it also. I have a feeling that it's pretty strong compared to clean air, I just don't have clean air to compare it to right now.