The checks and balances BitPay had in place clearly leaves a lot to be desired.
The fact that a company can just make payments valued at close to $2m just on the basis of an email clearly shows that their internal security and systems are not up to scratch.
I've I was the insurer I would also decline to pay.