Should you protect your Bitcoin address like your credit card number?
A bitcoin address is not like a credit card number. You can safely give your bitcoin address out publicly.

What the email is asking for is something you should never give out publicly: the mnemonic that you use (e.g. if you use Electrum, they have a 12-word mnemonic code), from which you can calculate your private keys. With this, they can easily steal all bitcoins on any address that was generated using that mnemonic.

If they actually wanted to know that you are the owner of an address, they could ask you to sign a message. There's not normally much of a reason to do this, though: I don't see a scenario in which a signed message is needed in order to give you money, instead of just the address.

If they actually just wanted to send you money (as they claim), all they need is your address.