<human>: I'll make this short and sweet.  The browser opened to my boyfriend's email.  He had a new spam message from "supereasysex", confirming his membership.

It looks very much like normal spam, except that it says it's made a username and password for him.  It displays both, and they are the exact username and passwords he uses for everything.  

The message is from half a month ago and was unread, and I logged into his account and it's completely blank.  I have no reason to be suspicious, but why would it know his username and password if it was generic spam?  

Anyone have any ideas here?

Give me a shortened version of the text
<bot>: Spam sex site may not be spam, but I'm not sure.  I plan to ask him about it, but would like input before I panic.  Please?