Hi Roger,
Thanks for the reply. Well, the messages have all looked pretty genuine to me. I did suspect phishing. But I post the header of one of the messages here for you to look at (I replaced the e-mail address I received this at with xxxxxxx),
x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensWQjutc4PB1AhsilHonqnf9e+7qB/K/hFRUa WZSQXRoCTQqXTJ7lb167EGUl1dSKztlmdxGjVtpNyIstfD+6kpL1r/ur38Y5mY7dwElfCXV4=
Authentication-Results: hotmail.com; spf=pass (sender IP is 17.151.1.53; identity alignment result is pass and alignment mode is relaxed) smtp.mailfrom=appleid@id.apple.com; dkim=pass (identity alignment result is pass and alignment mode is relaxed) header.d=id.apple.com; x-hmca=pass header.id=appleid@id.apple.com
X-SID-PRA: appleid@id.apple.com
X-AUTH-Result: PASS
X-SID-Result: PASS
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vSKhFmi4WwI4Kh+Jze51X5wgInS0JduvrOdSaFTCph9nVA6i4NSGGdPKTQrKHWmmRjxuPh W+yb65g0nWJ5Pv3v3U0Y16wRI3GF7ic88vkBs5FHMIHRvUNo0ssXxUuYlEImyjTvgUNEr903mBNzDumR 96fhCpSDKKTk=
Received: from nwk-txn-msbadger0303.apple.com ([17.151.1.53]) by SNT0-MC1-F47.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Thu, 20 Jun 2013 12:22:13 -0700
DKIM-Signature: v=1; a=rsa-sha1; d=id.apple.com; s=id2048; c=relaxed/simple;
q=dns/txt; i=@id.apple.com; t=1371756132;
h=From:Subject:Date:To:MIME-Version:Content-Type;
bh=qoDntm+JdBvONVFfyPZb2iBa2dU=;
b=oVp2WJEnwrPO0oSDr0+xfKFwHui/xIm8ipIiTgwz+Yjrtxh3BHDmNWibOy7nhu86
Ym02BBPcFZwjJ16QsRKWubTU0tUPXp1x6Tb39qGElvbN9LwFXNd11G3aEfKlat+J
zJ0igHSKtKtpMLXsnatshAJZNynxlhlpVpJfYGCbhJ3JVnbEJej5B6ZewyivQ0II
KXXUdyH9a/SunaxnMLeG54CR0MbAP2cDnxJnKQWE36LdZZ35PLBDa1ga2BK+VEdb
3lCG8XJLEfeFWRWBzzm6us07+ZtugQtBCma+wlUtozfunLU1QE4sn0+RJyeZIvqy
pfuSnbLvbZNPoUcs/VkOYQ==;
Date: Thu, 20 Jun 2013 19:22:12 +0000 (GMT)
From: Apple <appleid@id.apple.com>
Reply-To: do_not_reply@apple.com
To: xxxxxxxxxx
Message-ID: <226562172.23780691371756132580.JavaMail.roverp@nwk-roverp-lap18.corp.apple.com>
Subject: How to reset your Apple ID password.
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_1188870_1079653711.1371756132579"
X-EmailType-Id: 754000
X-Sent-To: xxxxxxxxx,2,k%2BmjWPCFEH1m5ry2zndhAmumlP8MsmMaHe88qBcDnaPdpSUceY3G8Djxz9L1r6zoB 4HegNyyOPjbx9zID3YEggObuZpSmV2CkZWjESqBHrXLjl2G02R8iCtAjtOxvPHqKDsDoHsju279MsU%2 Ff4WVTH3LP6nfHzf3zGvykU1pJ7M7eDsoSMm2UMknvlH9t8MtJ8Xv6dntb61x4BPv27kXYlSMiMYTG9o 6gCACdJc3QNcnG46qm8Dv8BznNl%2FMrGML%2F7ZFE4a2emYbfEV1ALKJ7Ay9%2B7O9of1urER0Xx6AT KpgUJAtGRG705NgQOobqy2DSiY746i04hJyHJbrrWZdTQ%3D%3D
X-Attach-Flag: N
X-Business-Group: DS
X-DKIM_SIGN_REQUIRED: YES
Return-Path: appleid@id.apple.com
X-OriginalArrivalTime: 20 Jun 2013 19:22:13.0141 (UTC) FILETIME=[77966450:01CE6DEB]