Googling "
[email protected]" (minus the quotes) brings up threads/topics on all sorts of different sites wondering if it's a phishing scam or not. The best I can come up with is, it's fake. Someone took the "forgotten password" automated email, edited it enough to make it seem legit, and emailed Ross with that account. Now I don't fault Ross for worrying, I would of done the same, I think it was wise he did.
[email protected] is commonly used for store and support e-mails. If you've ever bought a game on steam, submitted a support ticket, changed your password, etc., you will have received an e-mail from that address.This e-mail is probably not a scam. If you are really worried, these two articles do a decent job of explaining how to audit Received: e-mail headers.
http://techbase.msu.edu/article.asp?id=974
http://techbase.msu.edu/article.asp?id=2045
If it helps you at all, all steam e-mails I've received have had these two headers.
Received: from smtp01.steampowered.com ([208.64.202.37]) by [random relay server]
Received: from [10.3.3.29] (helo=valvesoftware.com)
by smtp01.steampowered.com with smtp (Exim 4.76)