Things suggested to me so far:

* Don't answer the email and don't pay anybody anything.
* Search for my address at [Have-I-been-Pwned][1]; if you find it, your password has been leaked, regardless of this particular person, and is essentially public now. He's just lame.
* Figure out the abuse reporting address for your mail provider (for Outlook365, it's abuse at outlook dot com) and report the incident there.

---

In my case, "Have I been pwned" says:

> Oh no — pwned!
> 
> Pwned on 6 breached sites and found no pastes

The breeches listed for me are:

* Collection #1 (unverified)
* Data Enrichment Exposure From PDL Customer
* GeekedIn
* Linkedlin
* Onliner Spamerbot
* Verifications.io



  [1]: https://haveibeenpwned.com/FAQs