Suspicious job email after applying on Indeed (job now deleted) / worried about email bombing or risk?

A user applied to a Sales Associate job on Indeed and later received a suspicious email from a Gmail address claiming to be HR, requesting background check confirmation. The job posting is now deleted, and the user is concerned about phishing risks and potential email bombing.