What I've learned, from them, is how to not get caught in a scam if you aren't sure.
Mainly, don't follow a link from the email to Chewy. Go to your search engine, and go to Chewy from there.
If you change your password, and you didn't need to, it's not a big deal.
However, if you follow a fake link that looks real, it can lead you to a site which also looks very real. Then, what you type in, such as your email and password, are in their hands.
Ds had something like that happen once, though again, not with Chewy, and it's never been fully straightened out. We were on the phone for a long time, he lost his account, and had to cancel his card.
Basically, delete the email, go to Chewy through a search engine that you use, change your password, and hopefully that will take care of it, whether the email was legitimate, or not.
Love All Life, Thank You For Posting! :)