Asking for private key equals to scam project/bounty/airdrop experienced crypto enthusiast as well as for those who knew the basics of crypto will not going to bite this bait
Those who are hungry with their worthless airdrop tokens will bite on this. It's like asking a kid to give their candy to a stranger. I can't blame also those people that aren't aware of this modus.
however, this would be a potential threat for newbie users and investors, I wonder where and how did they get emails and information from?
It's either they bought the list of emails or they signed up on it.
I heard some rumors that some projects are selling their investor's email and information most likely if the project is a scam.
Doubt it if you never signed up for an ICO but you received an email.