[code_Whisperer]

Thank you for your response. I don't see how they would have been able to, but the first email I received from the app vendor was a quarterly statement notification, and includes the person's screen name on the app. I checked all of the email headers and they seem legit (match emails I receive for my own account from the app vendor)

[mtmail]

Maybe user had an account and was able to change their email address? Vendor should've reconfirmed they're in control of the new email address.