@Pippy
The best thing to do is to log in to your icloud acct DIRECTLY thru icloud.com, and maybe change your password. I am sure those emails are scams. If you didn't get an alert from apple, it's highly suspect. Two factor authentication should have sent an alert to your device that an attempt to access your icloud account was attempted.
@MPCavalier thank you!