I received an email saying someone was using my Apple ID and to change password is this legit

There are piles and piles and heaps of phishing emails and cons and scams around, fake support telephone calls with spoofed (fake) calling telephone numbers, fake calls from “your bank”, spoofed mail messages with fake sender addresses, messages showing you your hopefully-old passwords (acquired from website breaches, always use unique passwords) and all manner of efforts to separate you from your credentials.

Facebook and Twitter and other platforms are swimming in misinformation, too.

Apple does not call you about these things. Apple locks you out at the servers, a d requires re-authentication.

Enable two-factor authentication, as that makes wresting control of your Apple ID that much more difficult. (You unfortunately may see odd locations on the two-factor messages in response to some authentication operation you’ve just done, if your ISP has mis-located your network address. Being mobile devices, iPhone and iPad cellular login locations also tend to be mis-located.)

As linked above: Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support

What was the sender's email address?

https://support.apple.com/en-us/HT204759

https://www.apple.com/ca/legal/more-resources/phishing/

If there was a link in the email to change your password, it sounds like a scam.

Apple will always address you by your name or the name they have on file for you, not Dear Customer, Dear Client or by using your e-mail address.  The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple emails won't have poor grammar/misspellings. Apple e-mails will never contain an attachment. Apple will never request personal information by email such as Social Security numbers, your Mother’s maiden name or full credit card numbers . 

The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.

Send the e-mail to Apple as an attachment to a new e-mail before deleting it. You can forward as an attachment by going to Mail/Message/Forward as attachment. Or control - click on the email and select Forward as attachment. Make sure you send it as an attachment to a new email. If you just forward it, it will probably be rejected. You won’t receive a response.

reportphishing@apple.com