Is the flaw on their side or your side?
The core flaw is depending on email for this. In fact it used to be a real-time API and the agency regressed to this. And their own system doesn't recognize invalid or undeliverable messages so it can get lost easy.