Another useful angle is to investigate their personal domain; who is hosting DNS, are they using DNSSEC, do they run their own code on platforms they have built

Another useful angle is to investigate their personal domain; who is hosting DNS, are they using DNSSEC, do they run their own code on platforms they have built-out? Where are their MX pointing? Gives a good understanding of how much or little they understand implementation & deployment. And, of course, check that they can sign their e-mails with their own PGP key :)