I never said I thought the email was a phishing attack, or that I thought it did not come from Twitter – said the opposite in fact. One of the main reasons that services should always offer a 'No – I didn't request that change' type link is so that they can make an effort to track down / ban the initiators of rogue requests.

This from WordPress: "To reset your password visit the following address, otherwise just ignore this email and nothing will happen."

I could include others. It isn't necessary a phish you received. Likely someone tried to login to your Twitter account and then clicked on Forgot password, and Twitter initiated an e-mail verification. Everything worked the way it should for your protection.

I may misunderstand the e-mail you received, but what you describe sounds like a typical verification. Of course, if you didn't initiate the change, you shouldn't follow a link to change your password.

I do use Gmail. In this case I just wanted to have a good long comparative look at the rogue email vs. a legit one from Twitter.