It looks like Apple may be trying to beef up security for its users. People signing into iTunes with an Apple account or using an iOS device have apparently been prompted to create or update security questions for their Apple ID and to enter an alternate "rescue" email address. A confirmation email from Apple then thanks the user. Understandably, people have been a bit dubious about the provenance of these notifications, but they appear to be legitimate, although Apple hasn't confirmed it officially.
The security features that users are being asked to use aren't new, and this notification can also show up if an app payment has bounced. Recent support forum threads, however, suggest that it's appearing more frequently than usual, so either Apple wants to make sure people are actually setting up questions or a bug or other tweak is causing it to show up. We were also able to purchase apps and update account information without being prompted, so clearly not everyone is getting the message.