Ask any cybersecurity expert, “What can someone do with my email address without a password ... You can always call the company to find out if the message is legitimate.