The only way to get them to make a reasonable response to these things is to make a redacted screenshot and shame them publicly on social media. Otherwise, your email is just an annoyance for someone who (perhaps proudly?) thinks "these customers think they are experts when we have a whole team dealing with security".