Email was definitely legit and directly from United. I looked up the reservation by confirmation number and last name. The reservation comes up just fine. There is no FF# or mileage program entered - so this is probably a kettle.

I guess one possibility is that they entered my email address by mistake during the reservation process (although unlikely since it is pretty unique).