You need to verify that they actually own (or at least have access to) that email address, otherwise all sorts of shenanigans could be had.