It is a security issue. If he were to lose his credentials then others could use his account to send genuine looking phishing e-mails. If you were defrauded and

It is a security issue. If he were to lose his credentials then others could use his account to send genuine looking phishing e-mails. If you were defrauded and had checked the email address as genuinely being from that address you might be minded to sue them. He could be targeted explicitly for this purpose now. Furthermore, he admitted to having read mail not intended for him and took no action to address the issue indicating that he understood that his address coincided with a namespace commonly intended for provider usage. It is unfortunate that the usage of 'noreply' has become so commonplace as to render his account a security issue. Perhaps they should give him some more time but he cannot keep it.