Is this legit or just a scam?

try logging into WOW. If it doesn't work and you know that the username and password is 100% correct, try the verification site. If you CAN log into WOW then yes it's a scam. Plus, the sender's email should have "worldofwarcraft" or "blizzard" in it somewhere. If it doesn't then, again, it's a scam.