I was contacted by my system administrator about this email, even though we chat roughly once a year; we get a lot of spam too but a legal threat is something you need to keep an eye on.
The things I would look for in an illegitimate email are not there. Where are the typos? The poor use of language? It is a very well-crafted email. The address is maybe a little off, but tons of my legitimate clients have weird emails like this.
It would have gotten my response... probably an hour of my time explaining how our policies work and how, yes, we would comply with their request even if the laws don't technically protect them. There isn't really a prefilled template you can respond to questions like this (if you actually care about responding inquiries like this) so I would have genuinely spent time thinking about the questions and giving them more than a yes and no.
