Can a company buy a debt from 20 years ago and then send you a letter demanding payment?

My husband got a letter in the mail saying he owed $400 to them. When he called to ask what for they said he had a jc penny card 20 yrs ago and that they just bought the company or the debt from the company and if he didn't pay them it would go on his credit report. We assume this debt was already on his credit report for 7 yrs and then dropped off. It doesn't seem fair that the same debt can go on the credit report for another 7 yrs. We're a paycheck to paycheck family and we don't have $400 bucks to just send away to every person that sends us a letter. How do we know these people are for real? This is 20 yrs old, he doesn't even remember this. Is that legal to put it on his credit report again?