If someone knows your email address, it seems like they should be legit.