Spam or not

It is a scam.

Did you provide any potentially damaging information to anyone? If yes, you'll need to follow up, for example, with a credit card company, Apple, your bank, etc.

If you gave you Apple ID password to a scammer, then

Change your Apple ID password https://support.apple.com/en-us/HT201355

Here is What to do [before] or after you change your Apple ID or password https://support.apple.com/en-us/HT204071

Increase/learn about security

See If you think your Apple ID has been compromised https://support.apple.com/en-us/HT204145

Increase the Security of your Apple ID https://support.apple.com/en-us/HT201303

iCloud security overview  https://support.apple.com/en-us/HT202303

Ways to keep your information safe on Mac https://support.apple.com/en-gb/guide/mac-help/mh11402/mac

Information on Phishing, etc.

 See If you see apple.com/bill, itunes.com/bill, or an unfamiliar charge on your statement https://support.apple.com/en-us/HT201382

See Identify legitimate emails from the App Store or iTunes Store https://support.apple.com/en-us/HT201679

See How to avoid scams when using Apple Pay to send and receive money https://support.apple.com/en-us/HT208226

For scam related information from Apple including reporting scams to Apple see Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams https://support.apple.com/en-us/HT204759

Remove associated devices for purchases

I believe the way to handle this is to use View and remove your associated devices for purchases https://support.apple.com/en-us/HT204074to remove his device. Yes, I am uncertain. I've only seen this issue once before and didn't add much in my memory banks about it. So, be sure what I am suggesting makes sense to you.

It's fake. Forward it to reportphishing@apple.com as an attachment and then delete it.

Apple doesn't use that address.

(180052)

You are very welcome.