Spoofed email detecting my Joomla version and vulnerabilities warning

Question

I got a spoofed email saying this:

Hi, this is just to inform you that your website is vulnerable to many bugs, and you are running an unpatched Joomla version. Please, fix this for your customers safety. We mean no harm, just to inform you of this. We did not hack email, we just spoofed it, we do not want be found.

This is technically true. I run Joomla 3.6.5. Although pretty low severity bugs reported on 3.6.5 right now. We are currently testing 3.7.2 but it'll take time to make the switch.

My questions:

1. Should I be worried that this is something other than a white hat hacker. Why would they hide their identity?

2. How did they detect my Joomla version? I like to think I've got myself well covered here, obviously not. I use AdminTools to block administrator access (/administrator), I obfuscate the meta tag and I have other htaccess restrictions in place. I've went through all tools and resources (How to check Joomla version on external website?) and I can't seem to find a way that they found my Joomla version.

3. The spoofed email (which is well obfuscated) directly emailed me. I don't have my email on the site anywhere. Technically I'm part owner but my email doesn't show up for the ownership of the domain or anything else.

Answer 1

Regarding point 2, the fact that they say "unpatched" rather than specifying a specific version could mean that they've just gone to a javascript or css file that has changed in a recent patch. 3.7 was a big change, so would presumably have a few of these.

If it was phishing (which from points 1 and 3, it doesn't sound like), I'd also suggest that sending these to all Joomla sites in their database would work - patched sites would just ignore it, unpatched ones may ask the questions you are asking as to how do they know.

Is your email in the users database?

Might be worth asking on security stack exchange, as their intent - and how they got your email - does sound curious.