1. It was sent by a compromised Illinois address and the recipients are clearly in alphabetical order by last name, pulled in bulk from that account’s Address Book.
2. The email does not address recipients by name.
3. The email is encouraging recipients to click a link directly. The link is not a University of Illinois domain.
4. There is time pressure and a threat of disruption if action is not taken.
5. Grammar and syntax issues like an ALL CAPS subject line, variable spellings of the service it claims to be about (Office 365, office365), no specific unit or group in the signature, and a copyright logo to give a sense of legitimacy.