For anyone else who gets caught up in something like this......

Keep everything, don't cash the check, and notify the postal inspectors.

Beside the cancellation mark, on the back of the envelope is a little orange barcode, hardly visible unless you're looking for it.

That's tracking data that the inspectors can use to tell where the mail came from.

There's also fingerprint data, etc.

Anytime you get something in the mail that you think is a fraud or a scam, don't hesitate to call the postal inspectors. It gives them something to do besides checking up on employees to see why they called in sick.