What's interesting is that both emails were for domains I won at NameJet. So "Jennifer" is using a very specific database.
Some headers:
X-cPanel-MailScanner-From: rgnet@heaven.proxyrefresh.net
Received: from heaven.proxyrefresh.net ([94.23.15.47]:39621)