So I get this forwarded from one of our employees:
The places where is says “person” had the employee’s email username, the places where I put “company”, it had the company name.
It certainly looks like we signed up for Cotap and let them send out an invitation, doesn’t it?
I strongly suggest that you not use Cotap. If they’ll send deceptive spam, they can’t be trusted for anything. Certainly not your company’s security.