I think merely treating it as a scam/suspect is an understatement. I think you're safe in guaranteeing it's a scam based on C alone   (though all three reasons combined should seal the deal). If anyone gets these types of emails they should just load up a bookmark and check their balance on the blockchain instead rather than clicking on links. The beauty of the blockchain is you don't even need to log in to see your balance as it's all there for anyone to see.