That is something you should always do when responding to an unsolicited offer, but there are two difficulties: 1) companies often outsource surveys to a third-party that no one has ever heard of, so an email from an unrecognizable source is not a guarantee that is not legitimate and 2) email headers are easy to spoof, so even if it says something like "[email protected]", it could still be fake. If the link in the mail is to an Amtrak.com address and uses https:// (not http://, the "s" is important!) then there should be a signing certificate which you can look at using a usually obscure icon in your web browser (such as a little padlock on the address bar, but this varies by what web browser you are using.) The holder of the certificate should be listed and is much harder to fake. Most newer browsers and add-on security products (such as anti-virus packages and malware filters) will check and block bogus certificates.Look at the email from sender. If it doesn't have Amtrak in the e-dress then it is likely spam.
As the sergeant in one of those old cop shows used to say at the conclusion of the morning briefing, "Be careful out there!"