No. In each case, the original message came into my own personal e-mail account. I had to click on a link to read the message, which I did the first time in all innocence. The second time, reacting to the timing (just a few days later), I didn't click.
GCT/OAT does have my e-mail address. But I never give it on the forum when talking about travel plans. And I do warn people who seem to be too forthcoming about private information. In any case, this e-mail is not the one I had before.
So either the message is legit, and I'm becoming paranoid. Or someone has been able to get into the GCT/OAT database. BTW, I was not the only one to get the first message. Someone (name escapes me) put a warning on Facebook.