I received an email from a person that is completely unknown to me, who claims that they were in an online master's program provided by my university department. They are asking for a recommendation letter for an application to a PhD program.
However, I am a postdoc and don't teach any classes. By quickly looking things up, I could not confirm that this person was ever even a student; however, it is in principle possible that they maybe audited some courses or otherwise didn't leave much easily accessible data.
My thoughts are that I should not even respond, because the request is, at best, entirely unreasonable, and at worst, an attempt to commit some kind of academic fraud.
What would be a best practice approach in this case? Would it be more professional to give a negative answer? Should I perhaps report this request to the department?