They should sue the pants off whoever shut down that email address. For many companies it would have been cheaper to pay than to suffer the damage that has already been done. And it would be easier to catch the culprits if people give them lots of cash because in spending the loot, they will make mistakes and make themselves visible to the police.

Now there is nothing to track until they rewrite their code and try the attack again with randomized email addrs