I think the biggest problem here is that the scammer has a way to include a message in the email.<p>I've discovered that if you offer any type of service that allows sending free text messages to other people, it will be abused by spammers or scammers.<p>For a variation of this problem, I once programmed a sign-up form that sent a confirmation email like "Hello <i>name</i>, please confirm your email...". As soon as spammers found it, they used it to send millions of emails by signing up and putting their spam message in the <i>name</i> field.<p>It doesn't matter how much info you put in the email around it (like a footer warning about spam). If the email contains any text that can be provided by the attacker, it will be abused.<p>Paypal should probably not include the seller note in the email, and show the invoice to the user only after asking if they are expecting an invoice.