I got a spoofed email saying this:
Hi, this is just to inform you that your website is vulnerable to many bugs, and you are running an unpatched Joomla version. Please, fix this for your customers safety. We mean no harm, just to inform you of this. We did not hack email, we just spoofed it, we do not want be found.
This is technically true. I run Joomla 3.6.5. Although pretty low severity bugs reported on 3.6.5 right now. We are currently testing 3.7.2 but it'll take time to make the switch.
Should I be worried that this is something other than a white hat hacker. Why would they hide their identity?
How did they detect my Joomla version? I like to think I've got myself well covered here, obviously not. I use AdminTools to block administrator access (/administrator), I obfuscate the meta tag and I have other htaccess restrictions in place. I've went through all tools and resources (How to check Joomla version on external website?) and I can't seem to find a way that they found my Joomla version.
The spoofed email (which is well obfuscated) directly emailed me. I don't have my email on the site anywhere. Technically I'm part owner but my email doesn't show up for the ownership of the domain or anything else.