FWIW, a brief Google search for any other examples of your notification letter from AT&T shows yours to be unique so far.....so either you're the first of many, or it may have actually originated from AT&T and there may be some smart device on your home network (I discount your iMac, even though it is running a legacy OS that is no longer being actively supported) that might have been compromised.
Have you done an expanded look at the header information on your e-mail to see if it might have originated from any other source than AT&T?
