No, don't hand over your password, as a matter of personal security.
Others here have mentioned that your former employer owns your former work computer and the data on it. If they provided the computer that's generally true.
However, all of that is entirely separate to your password. This is personal information that should be treated as confidential: you have no obligation to hand it over, ever. Your company is not entitled to know your password. None of their ownership over the data, hardware or software entitles them to know this. They are entitled to know and store a hashed version of your password (this is what lets you log in), but they are not entitled to know your password in plain text.
They should not need this information under any circumstance.
Speaking as someone in IT, if they have half-decent IT resources, they'll be able to reset your account password to something that'll let them gain access, which means they get what they want, and you keep your password private. Or, they'll be able to access your personal files anyway via an administrator's account, and will not require your password to do it. If there's full-disk encryption via BitLocker or some other product, and it's part of company protocol, they should have a plan for how to access your data without needing your information (speaking as someone who works for a company which uses full-disk encryption).
If they need your password for anything, it's because they bungled up their IT strategies somewhere, and that's their problem to deal with.
Of course, if you encrypted your work stuff outside of protocol (using TrueCrypt or etc) and it's the password for that stuff which they're asking for, then you probably do have at least an ethical responsibility to go in there and provide them with the work they paid you for. Meaning: go in there, decrypt it yourself, and take out the work stuff to give to them. Still don't give them your password.
If you're obligated, find another means.
I'll maintain that you should absolutely not hand over your password. You should definitely not respond to their email with it, even if you can tell it's authentic (it might not be).
Check your company's materials they gave you. If you have any obligations around this, offer an alternate arrangement, such as returning to the company to change your password. If you don't have obligations, decline their request. As I said, their IT folks should be able to handle this without your help.
Be willing to burn your bridges here.
Others have mentioned they may give you a poor reference if you don't want to comply. It's not worth sacrificing your personal security and confidentiality for the hope of a good reference, though. Further, you have no guarantee they'll give you a good reference if you do comply, but in return you'll be sabotaging yourself so they can get something they want which they shouldn't need. Given how they reacted to your leaving and how they've treated you previously, it doesn't seem you're going to get a good reference anyway.