I would try not to think about it. Yes, it's possible that it isn't spam but it's much more likely that it is spam and that they are trying to get money off you for malicious purposes. If there's not enough evidence that it's legit, then it isn't imo