I don't think "adware”, pop-ups, and browser spoofing / hijacking" are criminal (yet). In fact, I doubt many of the AMA folks that got the email would even know what the technical/ethical issues are. Personally, I would have simply responded to the email with a polite, "You must be mistaken" message, but your approach is valid as well. The sooner we get lawyers up to speed on Internet ethics and law, the better.