One way to check is to verify the email address he used. A reputable person from a reputable organization will normally use his/her company email address because he is representing the company... or the school, for this matter.

Second is to verify that the email was indeed sent from from the school's mail server. No reputable person will send business related/official emails from external domains. You may follow the steps outlined in this tutorial to trace the IP address: http://www.johnru.com/active-whois/trace-email.html

Third, you could refer to the organizational structure of the school to verify if the sender is indeed working in that school. Many school websites would publish the names of their staffs.

Lastly, there's nothing wrong with being vigilant. A legitimate employer would be glad to know that his potential employee is "street-smart" and knows when to ask questions.