I too got that email, checked the files in isolated machine.
The password.txt is a exe file with trojan.
But the wallet.dat file is true & it has 30.28 btc, but the wallet is encrypted.
The coins received from frosty wallet & it has another 3 addresses, which has label assigned to it.

It seems the scammer sent real wallet, encrypted, so that he dont loose coins, but want others to loose coins.