Kudos to the OP for standing their ground and not complying with the request. Apart from the principles, there is also a practical problem with complying with

Kudos to the OP for standing their ground and not complying with the request. Apart from the principles, there is also a practical problem with complying with such a request. How can one verify that the request is genuine? It could be a hacked email account from that domain. Or a rogue employee. Or someone who doesn't have sufficient authority within that company. How is the recipient of the request going to verify it?