The ‘From:’-address in any email can “easily” be spoofed, if the email application allows that — the email protocol itself doesn’t try to prevent it. In essence, the ‘From:’-address is meaningless for establishing legitimate emails. Instead look at the content.
Identify legitimate emails from the App Store or iTunes Store - Apple Support
Your point (1) and (2) indicate a scamming attempt. The sender not being specific to an issue adds to that. Them urging you to contact them, adds to that even more. Not sure what ways they suggest, but if through a webpage, that will go further through a rabbit hole of faked look-alike webpages and forms that are not on apple.com. If they suggest a calling a phone number, then that will not match with what Apple themselves lists as legitimate phone numbers on their site.
If you know how to read the email ‘headers’, then you can see its travel path from server to server in between, and thereby that it doesn’t originate from the apple.com domain.
If you don’t trust it, then don’t make contact, and be glad that you didn’t fall for it.
Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support