I just got a "Hallmark" card as a zip file attachment, upon checking the headers I discovered it was from:
from hallmark.com (gadianton.campbellsci.com [63.255.173.99])
And a traceroute actually points back to campbellsci.com!
Anyway, no-one should ever open such a thing, and CSI should probably check that machine...
Thanks William. Our IT guys are on it.