Fraud for nonprofits + is this a fraudulent email?

Our nonprofit organization has been the subject of a scam: someone ordered a phone in our name (delivered to our address) and set up an account without us knowing or approving. Apparently, scammers will then set up a way for you to send the phone back; they receive the phone and we will be charged. We returned the phone in person to AT&T. Recently we got an email with this return address: [email scrubbed]. Is that legit? We can?t talk to anyone in person at AT&T online until we set up an account with a PIN. The email does provide an account number and reference number and asks for the following: Thank you for contacting the AT&T Global Fraud Management team regarding the account number referenced above. We received your claim; however, we have not received all of the additional required documentation that was requested. For AT&T to proceed with processing your identity theft claim, you will need to submit all of the required documentation. If we have not received all requested documentation within 30 days of your original claim, the account will be canceled, and you will be responsible for charges associated with this account. Please be advised that the following additional required documentation must be provided in its entirety in order for us to proceed with processing your claim: Please be advised that the following additional required documentation must be provided in its entirety in order for us to proceed with processing your claim: * Completed and signed Identity Theft Victims? Complaint and Affidavit form * Proof of Identity of authorized party (current State/Government issued Photo ID) * One of the following: Valid Business license; registry of non-profit organization; articles of incorporation (first 3 pages); certificate of good standing by Secretary of State * Police or Law Enforcement report AT&T Global Fraud Management?att.com/fraud Is this fraud or should we provide all of the above to this email?