We had the following situation on a customer site:
1. User intended to add a "faked" email address. This adress is added to customers that do not want to receive an email for the invoice and do not need a printed invoice. (a hard copy of the invoice is delivered and when running duplicate invoice (after posting), it is not necessary to get a hard copy or an email). This is a valid process.
2. After adding the faked email econtct, user changed the email address to one of the real emails of this customers. This was a mistake.
3. As a result the email of step 2 above received all the emails that went to the faked email. There were many emails and the customer was able to see other customers' invoices which is always bad.

We changed the faked econtact details Name, Company, Address etc. to say DO NOT CHANGE THE E-MAIL !!! in order to prevent future mistake.

A warning " Are You sure you want to change the econtact email?, This can cause a problem " or similar message, could help as well.