It's legit and fairly common to be contacted by them if you've sold a car, even if it was a few years ago. NMR stands for National Mileage Register, which I believe is a service operated by HPI Ltd. Clocking is a big problem in the used car market and NMR helps by building a database of validated mileage that can be used by consumers and dealers to check the mileage of a vehicle they’re purchasing.

When an HPI check is carried out and there is a discrepancy between the mileage that the potential buyer is being told, and the mileages held on record, then HPI approach previous owners to verify the mileages at certain points in the car's history. Providing this information does not have any adverse effect on you as a car purchaser/seller in the future, it simply enables HPI to identify where the discrepancy has occurred.