I am currently experiencing issues satisfying them, so I think this is legit.
The sender's email address is ***@support.facebook.com, and I definitely do not think that their email servers + configuration would allow someone else sending emails using their domain name.
Also, they include your app ID, something which is (I think) not included anywhere in my source code, which they would not know were they not Facebook guys.
Also, they wrote to me using the contact email address I provided, which is different from my FB Developer account's email address.
Finally, they do not request YOUR credentials, but test credentials that they can use in order to check everything is working as intended (for compliance reasons). From what they told me, you have to create a test user (see here), register it on your platform, and provide the credentials of this test user so that they can check they can access your platform the right way.
I hope this helps!