So they actually use a [MENTION=1407]UNITED[/MENTION].com address, and you sent a reply to that [MENTION=1407]UNITED[/MENTION].com address and they replied from that address? Reminds me of this recent thread, where it turned out to be legitimate.

I'm not ruling out a scam, but using an actual [MENTION=1407]UNITED[/MENTION].com means either employee or breach*, and it's not part of the 99% of scams that just use spoofed email addresses. I'm assuming all email traffic going through [MENTION=1407]UNITED[/MENTION].com is logged, so if this is a rogue employee, then it won't last long.

Apply due diligence, confirm the email address on United's website (as they did in the other topic), call to a known and published number and try to get hold of the staff member that way.

*(Ok, technically it could also be DNS poisoning or malware on your end, but if it gets that elaborate, it's usually because they expect to make a lot more money than they could by selling a fake airline ticket).