At my company any email request like that is verified by a phone call. (Don't know if that would have helped here).