10 seconds is plenty of time to record IP addresses, do pixel tracking etc. Combine with data from a data broker and you probably have contact detail attribution.

heck, the payment processor plugin probably on that costume's site that's all they needed considering the email came from Paypal, which I assume you have an account with. an IP address lookup table internal to Paypal would do it alone.