I didn't request a change in my Apple ID and this was not sent to the email address that my Apple receipts are sent to.
Dear (my full name),
You recently requested a password reset for your Apple ID. To complete the process, click the link below.
Reset now >
If you didn’t make this change or if you believe an unauthorized person has accessed your account, go to iforgot.apple.com to reset your password immediately. Then sign into your Apple ID account page at https://appleid.apple.com to review and update your security settings.
Apple Support
The URL in the last line appears to be legit. The iforgot.apple.com goes to a nice looking web site, but I really doubt it is a legitimate Apple address. Am I wrong?