Maybe user had an account and was able to change their email address? Vendor should've reconfirmed they're in control of the new email address.