After a theft, a location alert or a plea from a supposed buyer can pressure you into changing the wrong setting. Separate device recovery, account security, and Activation Lock.
Separate the real data the sender may possess from the much larger story they want you to believe, then address the actual exposure without paying or engaging.
Creators and page owners have a reason to care about enforcement. That does not make an unsolicited appeal form the right place to enter credentials or grant access.