Unless you can independently verify the authenticity of the e-message — and that means contacting AT&T directly, preferably by telephone (and NOT by using any contact information within the e-message), so that there can be no doubt — you can pretty much be assured that it's a scam or worse. The fact that you received it on Christmas Eve (when it might be very difficult to verify its authenticity) also rates it as highly suspicious.
If it turns out that the e-message is legitimate, it would appear that your equipment is now part of a botnet and it needs to be thoroughly "scrubbed".
