Yes, that is a legitimate email and a legitimate Google group that we maintain. Tani manually sent that email to you. He is one of the primary webwork developers and he is the one that manages that email list. I just sent an important security announcement via that list recently regarding an important security vulnerability that affects versions 2.18 and 2.19 of webwork, and you should read that announcement and take the appropriate action stated in the announcement if you are using one of those versions.
WeBWorK Main Forum
Is a Google Group named WW-security-announce for real?
This forum has a limit to the number of forum postings you can make in a given time period - this is currently set at 10 posting(s) in 1 day