I think the best spam I ever got was this one, which is exactly how I received it (emphasis mine):
Dear (notjustjay)
,
We recently noticed one or more attempts to log in to your TD CanadaTrus account from a different IP address.
If you recently accessed your account while traveling, the unusual log in
attempts may have been initiated by you. However, if you did not initiate
the log ins, please visit PayPal as soon as possible to check-up your
account information:
https: //easyweb36w.tdcanadatrust.com/ (with COMPLETELY obvious scam URL in the link)