You probably shouldn't go directly through email consider they may sell you auths from the auth dump which will get banned soon enough.
Maybe get them to post the name of it on the forums so someone who has access to the dump can confirm it's not scavenged up?