Mark Kraitchman

documents the current “Google Drive Spam / Phishing Message”
incidents.

That web pages states –

At approximately 11:35am this morning, users across campus started receiving email notifications saying that someone has shared a document with them on Google Drive.

This issue is under investigation by Google and is not isolated to UC Berkeley.

If you received any of these messages, do not click on the link, and delete the email.

With respect to the bMail simplification program/project

bMail continues to handle @cs and @eecs bMail aliases
and bConnected lists (Google groups).

IRIS is now handling all other @cs and @eecs email forwarding.
This includes @cs and @eecs mail forwarding for people that don’t
have a bMail account and mailing lists that are not bConnected lists.
Formerly, the CalNet owner of such a redirect could update the
destination via the CalMail “Manage Your Redirects” gui
(graphical user interface); this functionality has been
deprecated/retired. For updates to all @cs and @eecs email
forwarding, please contact the IRIS Helpdesk via help@eecs

It is more robust for @eecs (and @cs) email to
be delivered to a bMail account or a
bConnected list. For helping converting an
email address to a bMail alias or a bConnected list,
please contact the IRIS Helpdesk via help@eecs.

During the February 16, 2017 until the morning of
Monday March 13, 2017 time frame, Google was sending probable
spam to @eecs email forwarding (handled by IRIS).

At 8am Monday March 13, 2017, Google was configured to
no longer attempt to send spam to @eecs email forwarding.
When bMail receives what Google determines is probably
spam destined for @eecs email forwarding, Google sometimes
bounces the mail back to the sender as “Address not found.”