The email is legit, but you can login to your account and go from there. (I did)
ATT is asking all customers to add this extra layer of protection with a 4 digit passcode on top of the user name and password.
you will need to remember this to login to your MY ATT account on your phone.