Better to reply "yes, we are affected. Your support contract has expired, please renew at XYZ".
Of course it's also plausible that that's not fraud at all. But I have no way to know for sure unless I ask a lawyer, which needless to say I wouldn't do. And if it turns out that it is fraud, well, the legal department of Fortune 500 companies tends to be pretty humorless.
Departments (small managers) are authorized to spend small money without approval, lets say up to 200 euro/month. If they send this type of emails, someone ass is on fire. They will DO spend it just to get legal green light.
Anyway, I do not see reason to hold back, just because I am open source developer.
This is basic marketing. Airbnb, Facebook, Amazon etc are allowed to do shady stuff, but single contractor should be clean as lilium?