A customer for 4 years and they delete everything after 5 weeks? Can you really defend that? It's pretty clearly a bad policy. You're being facetious about other contact methods, but I think that's a great idea. Allow users to add a phone number. Some people have faulty spam email blockers.