Email isn't secure. It's unreasonable to expect that to be sufficient to cancel anything with consequences on its own. I agree that the company is in the wrong here, but not because they wouldn't take significant and possibly irreversible action based on just an email that could have come from anyone.
"Email isn't secure, that's why you must make a phone call because the only way we can verify it's actually you is by hearing your voice, which we've never heard before"
