The new level of scam hit me today. Got an e-mail: "Do you have a bounty program?" This would be fun, thought I, and I answered, "Yes!" The vulnerability they'd "found" was that you can use my domain in the FROM header of the email. How cool is that! So much spoofing!
After I described that that's how email works and the reason we have DKIM, DMARK, SPF, and all of those things, they asked for $20 for a heads-up as appreciation.