There's a sage piece of advice that's always relevant in these cases and it's very simple: if in doubt, go the website in question and verify the request yourself.
Now the spamer has confirmation that this email address is active, can be shared in their network.
Edit: email address