Note that the quote from the original scam email appears to be missing the critical detail. You have to look at the actual URL, not the label which the browser will display. And then there are some tricks in how a URL can be written which will obscure the actual destination. I have several different userIDs on my machine. Most of the stuff hits all of them, not just the one I use for Paypal