The antecedent of "they" in the previous sentence is the company, not an individual. The individual creating the email, as a person, probably was not lying BUT since they were acting as an agent of the company, in an official capacity all of their actions were that of the company as a whole.

This shields them from individual liability as well as makes the company liable for their actions (as long as they are acting as agents of the company in an official capacity).

The customer has no business relationship with the individual customer support person, so whether they are lying or telling the truth is irrelevant to the customer -- they do have a business relationship with the company (a single actor, with multiple agents) and the company can easily tell lies via these agents.

If the above narrative is correct, the company did very likely tell a lie since the fact that the customer's data was recoverable was probably known by the company and also the company likely actively worked to make the opposite of this known via their agents.