I received this email - Is it ligit? Or if it is phishing, should I forward it to some Yahoo authority?

Since they are using a Hotmail address to harvest the identity theft data, you should forward it to abuse@microsoft.com and abuse@msn.com