I just got notified about a payment from them. I wondered about it being legit but it seemed to have all the correct info. I was a bit concerned that anyone who got that email could have collected my money and that the only verification done was a code sent via a cell phone number that *I* entered during registration, as opposed to sending it to the email address they had on file. Good news is that this was a one-time setup and future payments will go to the same account, which they were able to verify online.
ATH really should have sent a separate email at the same time as the payment was submitted so we would know what was going on. Someone said we had been notified and I vaguely remember getting something a while ago but cannot find it at the moment.