If you don't trust the email, simply ignore it and United will disregard your privacy request. I'd be more concerned if United was allowing people to make requests in my name without any sort of verification.