Nothing. People make this mistake when doing legitimate things too. You're meant to make a new address for every single client. The response could be that they only send to unique TXID that haven't been used before, but you can always race it out by sending the email first.

Smart sellers would require you to sign your message with the bitcoin address that paid.