The bottom line is that bog standard email is an inappropriate method of communication for anything important. We don’t bank or send invoices or payments by standard email because we know there are a bajillion ways for it to be compromised.
(Email notices out of accounting software packages are different kettle of fish)
CASA have all the secure methods of identification and communication of the federal government at its disposal. Think myGov/mygovid etc. They even use these for things already (medical-licenseing etc) via their own secure portal.
So it makes no sense for them to send things like this via email.
Just asking for trouble and/or convenient deniability.