Not sure how they got so many emails but it was not from opencart.com.
This is the email
From: Update Alert <email@example.com>
Date: Thu, May 24, 2018 at 5:06 AM
Subject: Enquiry Update Alert
OpenCart Security Update 3.0.4 – Update Immediately
OpenCart Core version 3.0.4 has just been released.All previous versions of OpenCart core are vulnerable to RCE attacks.
To update OpenCart, please follow the link in this message.
Opencart Security Team