Obvious this is a scam, and they want to steal your private key
And download link isn't from MultiBit official link (multibit.org)

But i wonder how did the scammer get your email address ?