If your only method of contacting your customer is via email and the email is demonstrably controlled by a hacker then you have a hacker for a customer.
If email isn't your only method of contacting your customer... then sending an email to an address controlled by a hacker isn't your only option.