This is really unpleasantly sneakily nasty.
I get a lot of spam at my job number 2. A lot. As in, I had spam coming in between my email address being created and my computer being configured, a process of about five minutes.
I have sent literally nobody an email using that address, because I can't access it remotely, so I just use my gmail address.
And this morning, after a week of not being here, I had 85 "spam" and 25 "junk", or thereabouts.
So I'm quite aware of spam at the moment, and then I delete one message, and get a note saying that the sender has requested a read receipt, and do I want to send one?
For those of you who may not know: Spam doesn't just get sent to legitimate addresses. It gets shot-gunned to addresses, based upon likely addresses built up out of name databases. If you ever reply, however, or in some way confirm that this address actually works, then your address goes from being a may-as-well to a very valuable commodity, and you will never be free of spam for as long as you use that account.
The good part here is that receipts like this appear to be a Microsoft invention, or at least something that I have only ever encountered using Outlook. If you use a different program, particularly a web-based system, you probably don't need to worry.
Which basically means that the most vulnerable people are those in a uniform corporate IT environment.
As they didn't already have enough pain to be going on with.