This message was identified from a legitimate user, but the contents of which are not legitimate. Even if the sender is known, make sure to check for the other signs. If you don't expect what's being requested, this is a good chance to pick up the phone and call the sender.
Please report any suspicious emails to firstname.lastname@example.org. Better safe than sorry!