Thanks for all the help.

The email address it was sent from is [email protected]. The email header reads "UK Refunds & Ticket Retrieval Case Reference Number XXXXXXXX"

They did have my PNR and ticket number correct in the email. There's no documents attached or any links, even to the ba website, within the email.

It is true that I just redeemed nearly all of my 100,000+ avios point balance for an award, I certainly hope nobody is trying to get access to those points.