Wasn't this dismissed as incorrect? The extra email address was the one listed in WHOIS and used to be a valid option in the web UI, and is a reasonable choice for issuing domain-validated certs?
I remember the same thing, and as above - already been discussed a lot