I've had one supposidly from 100% trackdays as they'd had a virus that rifled through their address book.
Also one under the guise of Virgin.net saying they had detected a virus from me and I was to click on a link etc. etc.

Basic rule is: if your not expecting it or know who it's from then delete it.