I've gotten a few similar spam/phishing notifications from github recently too. It showed that my username was tagged in the issue (along with 10-20 others).