Wasn't this dismissed as incorrect? The extra email address was the one listed in WHOIS and used to be a valid option in the web UI, and is a reasonable choice for issuing domain-validated certs?