Alright, first, relax, this is 100.00% a scam and you’re definitely not the first person something like this has happened to. The email is well over a month old, and clearly nothing has happened yet. With that in mind, there’s a few things you can do.

1. Report abuse to Gmail/Microsoft/Yahoo so they can shutdown the account. You should also inform your school.

2. Change your password to something very complex

3. Add a phone number

Sorry if you wanted a more technical answer, but there’s really just no need here for that lol, that’s about all you can and should do