Regulators need lingering audits to make sure email address details are reasonable