[sdca]

Could the hotmail address have been allowed because it's listed on his domain name's WHOIS?

[Trellmor]

Maybe. StartSSL used to allow using E-Mail addresses from WHOIS records for domain validation and it's possible that this code was still in place on the backend.