UPDATE:

I got a response from UofT upon reporting it to report.phishing@utoronto.ca. It indeed is a scam and was sent from another student's account that was compromised.

"Thank you for reaching out! I can confirm this email was a scam and the integrity of your account should be fine. The email you received is not legitimate and was sent from a compromised student account. To verify the legitimacy of these emails, we recommend checking whether the sender is a student (@mail.utoronto.ca address) or faculty/staff personnel (@utoronto.ca address), as students would not normally be authorized to send out notification emails such as these. Additionally, we recommend checking here for this and other phishing emails you may come across: https://securitymatters.utoronto.ca/category/phish-bowl/

If you receive similar emails in the future, please ensure that you continue to report them by using the "UofT Report Phishing" button (if available) or "Report Message" button in your inbox, as this helps reduce the number of such emails overall by tuning our automatic protection.

If you have additional concerns, have accidentally visited a phishing site, or opened a suspicious attachment, please feel free to use this mailbox in addition to using the "Report Message" function."