how do I tell if a receipt from Apple is legitimate? I received one for a purchase that I did not make and when I attempted to cancel it, I was asked to supply some very sensitive information

Fake. Thousands of these go out every day.

Common signs of fake receipts.

1. Spelling and grammar that reads as if the person just started learning English last week.
2. Links or big buttons to cancel the purchase or login to your account. These are NEVER on real Apple invoices.
3. The site you get sent to asks for sensitive information, like your mother's maiden name, Social Security number, etc.
4. Nonsense information that states how the purchase was made. Like a particular type of web browser.

Apple will always address you by your name or the name they have on file for you, not Dear Customer, Dear Client or by using your e-mail address.  The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more.

The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.

Avoid phishing emails, fake ‘virus‘ alerts, phony support calls, and other scams.   

Identifying legitimate emails from the iTunes Store.     

Send the e-mail to Apple as an attachment to a new e-mail before deleting it. You can forward as an attachment by going to Mail/Message/Forward as attachment. Or control - click on the email and select Forward as attachment. Make sure you send it as an attachment to a new email. If you just forward it, it will probably be rejected. You won’t receive a response.

reportphishing@apple.com