They may be blowing smoke about a lot of that but the bottom line is that nothing prevents a lawsuit from being delivered to your door. And once that happens you get to pay an attorney a barrel full of money to properly defend you.
I suggest you profusely apologize to these people and remove the email account. If they then want to continue doing business with you, you can create an email with your business name followed by a numerical code to identify the customer.
I'm surprised that you've done hundreds of these without getting smacked yet.
In the future get written consent before you create the email address or use the numerical coding that I suggested.

