The user received a legitimate email with a return address using their text mail address. However they didn't send the email, they only received it. The sending address is their phone number @ mms.att.net
The user has an iPhone, an iPad and an iMac. The email was received on the iPhone and iPad, but not on the iMac.
Is there a way to see the header on an email received on an iPhone or iPad?
They have since called AT&T and made sure that they don't share their phone number account with anybody else.
ATT told them that they also share a satellite TV account with another person, but that this other person is the only control for the shared account.
The user changed their iCloud password, and confirmed that they have 2-factor authentication turned on.
My guess is that their phone number is embedded in the Mac Messages app on some computer somewhere, and that when a file was 'shared' the Messages app sent the file using a wrong phone number.
Naturally, they don't want people sending out email using their AT&T phone number
Any idea how this return address appeared?