Well that’s a bit annoying.

I used to get 10s of these a day, a few (5?) years back - or at least I assumed at the time that were something similar, and that Microsoft weren't actually sending out hundreds of security updates a week (Unix users should feel free to use that as a set-up for a joke).

It's potentially a very effective avenue of attack as many users don't expect the "from" address to be spoofed - although one would hope their email client would pick up on this.