It might seem legit but there are several reasons why you should not always hit the panic button when someone claims to have your email password
Education: I highly recommend it.
Position: Security researcher
Most-loathed malware: Whatever afflicts the customer
Golden Rule: Never open attachments or links in unsolicited email (or IMs, or whatever), even when they appear to be from those you know and trust; Silver Rule: Protect your privacy!
First computer: Digi-Comp