People should have also checked submittable after receiving the email as a validation check - without relying on the email alone. Email is not very safe/reliable (as we see in this case). With the usual caveats, a secure website is usually safer.