User gets this message: "threat has been detected'

Must be from the antivirus on their PC. Have them whitelist your email or domain; hard to say what to do becuase antivirus apps are all different.

Ok. Thanks. But is my site presenting an actual threat?

I’d scan your own site to be sure. Use https://sitecheck.sucuri.net/

Ok. Thank you. I did and it comes back clean. I also have the sucuri plug-in I’ve been using. Thanks for your help!

Sure, that’s fine; sounds like it is on the user’s end.