My son also received the request from the Chicago Cubs and MLB. He is a sophomore in JUCO. His advisor too said it was legit. We had to complete his physical and then submit it separately from the prospect link and they sent us a email that ended in mlb.com so I agree with the poster above that it is legit.
Everybody is kinda leary of phishing schemes and I guess until the word gets out in amateur baseball that this is how MLB does it, I guess there will be some skepticism.
The video is awesome that is on the prospect link. Very exciting.