I would take it as a legitimate email. Two questions:
1) Are they actually allowed to enter the US now? Assuming yes:
2) Did they have a booking for some flights that might prevent legal entry to the US (for example from Schengen to US in the past 14 days). Even if they didn’t use the ticket and/or the flight was in the end cancelled, I have heard of airlines pushing the PNR data leading to the cancellation of some totally unconnected ESTAs.
Get to the airport very early and expect to apply for a new ESTA (praying it is processed quickly). It may make sense to apply already now.