Isn't point #1 and (partly) #2 incredibly dangerous? Sender field is easy to spoof, and while advice to go directly to their website is sound, it doesn't explain what "checking the link" actually entails, and many might not know a link in an email can say one thing and take you somewhere different.

So people reading this might be _more_ susceptible to future, more sofisticated, attempts of the same type, rather than less.