[merlincorey]

Your client's /Round Cube/ installation may be exploited, as that is where the email originated from:

  User-Agent: Roundcube Webmail/1.3.3