HostCart will not ask for your password or root password by email.
Check links go to https://hostcart.net. When unsure, sign in manually and open Billing/Support from the console.
Report suspicious messages via an Account ticket.