I thought this article from the NY Times might be useful for some. Mary Davidson
Messages About iMessages, but Not From Apple
By J. D. BIERSDORFER JAN. 30, 2017
Q. I got an email on my iPhone from "Apple iMessages" saying my user name and password had been used to log into an iPhone 6. I do have an iPhone 6, but if this is spam, how do they know? I am temporarily ignoring this, but what do I do now?
A. For years, online criminals have tried variations of the account-security email for Apple's iMessages, iTunes and iCloud services to lure recipients into clicking on malicious links or providing Apple ID account information. By including the name of the iPhone model in the message, the sender is hoping to get your attention with specifics. Adding the name of a model still in widespread use broadens the potential audience for the message.
Some email messages that appear to be from Apple may look convincing, but tap the sender's name in the From field, left, to see the address it actually came from, right. The New York Times
Even if the return address on the message says it is from Apple (or one of its services), you can usually see the account it really came from by tapping the sender's name in the message header. The next screen shows the actual address. If it is clearly not from Apple, forward the message to
reportphishing@apple.com.
For more information, search Apple's support site for its page of other tips for dealing with suspicious email. If you think that you may have been hacked, the site has a set of guidelines for compromised Apple ID accounts, along with instructions for seeing a list of the devices that are using your Apple ID credentials.
Online criminals target Apple ID accounts because they often are linked to credit cards for iTunes or App Store purchases. (Amazon accounts, Google accounts, bank accounts and so on are similarly linked.) Shoring up your personal security with two-step verification and regularly changing your password can help keep your account more secure — for your Apple ID and any other e-commerce or social media services you use.