As someone who gets hit by reverse identity theft[1] regularly, I'm convinced that requiring anything other than "proof that the email address is actually yours" makes you scum. If your only point of contact with a customer is an email address that isn't actually theirs, they aren't getting your communications anyway. And with that, I'm off to call a hospital I've never been to because they don't even have an unsubscribe link or any email point of contact at all.
[1] http://xkcd.com/1279/