Junk email is very annoying, and I'll be happy to discuss it further if anyone asks. I have common sense, I hope. First, you're absolutely right that some of this is common sense. Lots of users still have not built up their street smarts yet, and are still learning. I suspect this is for the reason I'm about to speak of.
Crackers can send fake email without much problem.
It's not hard to send a note that looks like it's from a system administrator. We've had a break-in, and I need your help with some testing. Then you can change it back. No system administrator will ever need to ask you this. Someone else is waiting until you change your password so they can break in during those 2 minutes.