FDA is spelled Fda, he doesn't capitalize the fda and dea later in the email, ip isn't capitalized, the last name looks like it's probably mispelled Gonzalez vs. Gonalez, and then looking at the header info of the email, it's showing storedsecure.com and easystorecreator.com as the sending servers, which both are for people to setup their own stores (and probably emails.)
Received: from rs3.storesecured.com (rs3.easystorecreator.com[69.20.11.181](untrusted sender))
by rwcrmxc18.comcast.net (rwcrmxc18) with ESMTP
id <20060124133700r18005bojse>; Tue, 24 Jan 2006 13:37:00 +0000
X-Originating-IP: [69.20.11.181]
Received: from manage182.easystorecreator.com [69.20.11.182] by rs3.storesecured.com with SMTP;
Tue, 24 Jan 2006 05:28:33 -0800
From:
To: xxxxxxxxxxxxxx@xxxxxxxx.xxx
Subject: GETPINZ.COM INVESTIGATION
Date: Tue, 24 Jan 2006 04:59:36 -0800
Message-ID: <20060124-04593678-1160-2@S72918>
MIME-Version: 1.0
Content-Type: text/html
Plus, it should have arrived from DEA.GOV, not DEA.COM. So I'm pretty confident that it's someone trying to spook us. Now, how they got our emails, ips, and know they were associated to getpinz.com is something else to think about.