Email can easily be spoofed, so caution is required. A person cannot be uniquely identified by email alone. It may be used for general communication, provided the email address is not further used for marketing purposes.
How to verify a client when I only know their email from a GDPR perspective
How to verify that someone is a client? If they send me an email, what purpose should I save it for?
Written by Petr Pech