Many (real) police departments don't actually have such an address, so that's not a reliable test.

Also, maybe not relevant for this discussion of AT&T, but what about "law enforcement" outside the US? My point is more broadly about the problem of verifying a request really and legally came from "law enforcement."