Hi, I work for Moz. It's not a phishing attack, in fact we sent the email. You just need to go to moz.com/login to start the password change process.

There's more info in the post here: http://devblog.moz.com/2013/06/how-we-fixed-a-password-expos...