Whoa, now he's collecting peoples personal IDs as a condition of refunds. This is cute :0
have you read why? EMAILS can be faked, to be more precise, senders email address can be fake so the attacker since he have all our emails and balances can very well send emails in our name with his BTC adress, is that so hard to understand?
can't be faked... The attacker only has the hash of the password hash, so no juice there...