Looks fishy, usually exchanges will tell you that you shouldn't share your passwords to anyone but on this case, they're the ones sharing their user the password made for them. What's the email domain that's been used on that email sent to you together with that instruction?
Interesting discovery! I open the link several times to see what will show up and it's always 4.4 on my end, does this mean that Playstore gives a different rating based on location, if this is true I am not aware of this only now, so it's deceptive if we just rely on these reviews because it's based on location?
I think it's just a range and it changes, looking at the same app has got the same 9.03k reviews but 3.2 stars.