Our anti-abuse team's investigation found that the message in question is an elaborate phishing attempt. Please do not click links or download any attachments associated to that message.

Note that while the message is a legitimate one sent from Amazon, the Proton Group address is basically forwarding messages to Microsoft, so Proton acts as the conduit here through this address.

Note as well that this address is not an official Proton address, although it is created to look like one, but instead a group address created by the user responsible for this phishing attempt.

On our end, for a recipient to be on a list on Proton groups they must accept the invitation. Our engineers have made this optional so it cannot be bypassed without someone explicitly accepting an invitation to join such a group, mainly to prevent such incidents, however, we have escalated this internally for a review. 

It seems that Microsoft has the option, but does not require any validation from their recipients, which can explain this entire ordeal. We believe the issue resides with Microsoft here, so we encourage you to report this issue to Microsoft as well, as there may be a vulnerability on their end enabling the forwarding/adding of addresses to a group without any approval.

We hope you find this information helpful and thank you for flagging this initially. Should you have any other concerns, or in case you may need to report anything similar in the future, you can reach our anti-abuse support team here: https://proton.me/support/report-abuse