How can my phone recovery number change?

They cannot change anything in your apple ID without your Apple password.

Recovery numbers were before two stage authentication was introduced. Now you have trusted devices and you can add a trusted phone number to receive authentication codes. Is that what you mean? Still only you can change it.

Some emails are scams to phish for your password. Provided you logged into icloud separately and not using a link in the email you are safe,