It IS Medco, and it IS legit. They have your address, but likely your doctor submitted a prescription, and they need to confirm where you want it sent. They're not going to assume that it should go to the address they have on file, because that's not always the case.