Postnet not meeting the its obligations under the POPI Act?

Why have I received a phishing email (from: PostNet <***>) advising me that "Postnet informs you that your shipment number ZA000152A20 is waiting for your instruction: Send my package. You must pay customs fees to complete the shipment" Given tracking # produces in your web site tracking functionality so it appears to be a phishing mail. But why do I receive it? Where does sender get my email address from? What does this say about your protection of customer's personal information? What does this say about your observance of the requirements of the POIPI Act? Why am I exposed to potential ***** risk because, apparently, you cant exercise the legally obligated protection of my information as required by the Act? PS: It appears that you have been targeted by a syndicate. I say this because I have also received a similar mail, purportedly from CourierIt, also quoting the above shipment #