Agreed. It's easy to say without being in the situation, but I think IT should have said 'use this link just in case' since they knew it was a valid link. If you get an email like that which could be phishing, it doesn't hurt to change your password anyways. I just always make sure to go through the site myself and do it.
Yeah, years of Blizzard accounts have taught me well. That's why I don't think HFA's IT guy would be incompetent. It's basically not an IT situation, it's a "I'm under 40 and I know how to operate an Internet device" situation.