It is probably a legitimate request.  That does happen from time to time.

As a precaution, I always suggest looking for the the website (or phone number) through other means (such as Google), rather than relying on the letter that a person received.

https://www.irs.gov/identity-theft-fraud-scams/identity-verification-for-irs-letter-recipients