If someone's willing to pay for fastmail, why not also set up a custom domain? That seems to mitigate the security concern.