>I wonder if you can forge (or possibly man in the middle) such a request (there's no digital signature of the letter I suppose). You'd need to set up a fake agent persona with phone number and fake signature. For a criminal organization that doesn't seem to be an unreasonable afford.

Using fake subpoenas to dox people on IRC seems to be a regular thing, I don't see why not NSLs. (Besides the fact that NSLs might actually receive some scrutiny, so they're probably the inferior choice there)

Most people will just comply straight away.