Him sending an email to the .np cctld has nothing to do with the hack he's talking about. More likely, his plain text email was intercepted 'on the wire' and would have been the same to whichever cctld he would have sent to.