Spam

Apple will always address you by your name or the name they have on file for you, not Dear Customer, Dear Client or by using your e-mail address.  The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple emails won't have poor grammar/misspellings. Apple e-mails will never contain an attachment. Apple will never request personal information by email such as Social Security numbers, your Mother’s maiden name or full credit card numbers . 

The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.

Avoid phishing emails, fake ‘virus‘ alerts, phony support calls, and other scams.   

Identifying legitimate emails from the iTunes Store.     

Send the e-mail to Apple as an attachment to a new e-mail before deleting it. You can forward as an attachment by going to Mail/Message/Forward as attachment. Or control - click on the email and select Forward as attachment. Make sure you send it as an attachment to a new email. If you just forward it, it will probably be rejected. You won’t receive a response.

reportphishing@apple.com

See these security-related documents, especially the first two.

If you think your Apple ID has been compromised https://support.apple.com/en-us/HT204145

Security and your Apple ID https://support.apple.com/en-us/HT201303

iCloud security overview  https://support.apple.com/en-us/HT202303

Ways to keep your information safe on Mac https://support.apple.com/en-gb/guide/mac-help/mh11402/mac

Using app-specific passwords https://support.apple.com/en-us/HT204397

UseTwo-factor authentication for Apple ID https://support.apple.com/en-us/HT204915

___________

Ann assuming you are using two-factor authentication ,Check your Apple ID device list (https://support.apple.com/en-us/HT205064) and remove any device that shouldn't be signed in using the steps in the link.

If there are none that shouldn’t be signed in, then you should not have a problem at this point. But, if an unauthorized device signed in, Change your Apple ID password https://support.apple.com/en-us/HT201355 

Here is What to do after you change your Apple ID or password https://support.apple.com/en-us/HT204071