Comment by hackhat

Imo the problem is of the issuer. They only opens holes by doing this kind of things. Imagine if you already secured the [email protected] and tomorrow the issuer thinks that [email protected] could be used for validation. Now what, you should keep up with their updates every hour?