I’m receiving requests to change the admin email. How can this be happening?

I think someone entered the password reset form and you probably have an easy user login for the administrator like ‘admin’ or so, so that’s what they probably entered.

The email also says:

You can safely ignore and delete this email if you do not want to take this action.

So just ignore it.