I would read this topic and the answers, and look at the dates. Even though the Intuit people felt these were legitimate, they were clearly spam. I don't know if Intuit people can trace the initiating request. This might be interesting to be informed of.

https://quickbooks.intuit.com/learn-support/en-us/employees-and-payroll/i-have-been-getting-suspicio...