I would trust this much more if the email address had the mail.med.upenn.edu domain.
Or if it demonstrated a modicum of context-awareness, i.e. not posting "you are being invited" on a public forum. Or if Research Specialist had a name. Or if it got the name of the laboratory right. Or...
There's been a bit of discussion about TDCS here on LessWrong. If you don't know what TDCS is here's an article from Technology Review.
Here's a company (soon) selling a DIY kit to build your own.
Here's a video from Journal of Visualized Experiments on how to administer TDCS.
Thoughts?