Email headers are trivial to fake. If you want to, you can review the 'raw email headers' and figure out from the normally hidden headers whether or not it actually came from DU. But generally it's easier to just not believe addresses in email and assume it's forged.

Ages ago (I think it was 1979) I demonstrated to my boss how easy it was to fake an email to him from his boss, accepting his resignation. The email protocols are only a tiny bit more secure now. They're just not designed to be secure.

I get email all the time, forging my email address as the sender, claiming that they've broken into my computer and sent me mail after logging in as me. It's never true.

Is that someone with whom you share emails has picked up an email worm. The worm goes through the infected computer, read emails and address books and fires of garbage emails made up of text scraped randomly from the infected computer.

That's how it knows your email address. It's also possible that you have the worm active on your machine. Full virus/security scan should find it.

Although I have an iPhone 6 too. Dodgy eyesight and hearing. Arthritic hands. I'm a wreck so I only use internet on my desktop machine.

Here's a couple of links from trusted sites. It doesn't say if they are all free or not.

https://www.techradar.com/best/best-iphone-antivirus-app
https://www.lifewire.com/best-antivirus-for-iphones-4769836

This one is free and might be a better bet than Avast (which is also free but resource heavy):
https://www.avira.com/en/free-antivirus-ios

Good luck.