My wife received an email from "customer amazon@" the message was completely blank and the ''payload" a small 80kb PDF file. In that PDF was:
Billing Your Account ]
She does not have an Amazon account.
Apart from the blank message the other clue was the randomised alphanumeric string before the @Symbol in the otherwise hidden part of the From address. The visible part was an innocuous mailer address. The hidden domain address was fake.
Searching the URL in the message revealed our old friend Google
All forwarded to SpamCop etc