Is an email from @email.apple.com legit?

@email.apple.com is, yes, a subdomain (not an account) Apple uses normally for informational emails. From the iTunes store, iCloud services such as find my iPhone etc...

But as was said this can be easily faked or spoofed, so just because the address is one apple uses, does not guarantee the email is from Apple.

The no_reply bit means there is no actual account behind that address to send email to.

It's where my emailed iTunes receipts come from. If it is a legitimate email, and if you didn't log or re-log into your account in Messages on an iOS device or computer yourself, change the account's password via http://appleid.apple.com (What to do after you change your Apple ID email address or password - Apple Support)

Depends on what the email says. The Sender address can be easily spoofed, so just because it appears to come from such an address is no guarantee.

What exactly does the e-mail say? If it has any links, do they take you to actual Apple websites?

What is it asking you to do?

Is the email personalised, and have proper English (or whatever language you have emails set to be in) and grammar ? And if the email has any links in it you've checked them (e.g. by hovering your mouse pointer over them ? My emailed iTunes store receipts come from 'no_reply@email.apple.com', but it's fairly easy to spoof the 'sent from' address on an email