Why should it matter what they look like if someone from Salesforce says they are legit?
This would be a stupid thing to do, even at the office. They could listen maybe the director of physical security, etc, but not a random employee. Especially for a company of Salesforce's size.