Yes, which is why just set the bar at responding to any request for any data with "Sorry we do not respond to requests for data that aren't court ordered warrants. Please come back with a warrant we can verify."
The problem here is that companies have a policy of trusting some government email address for little one-off, no warrant needed requests. Don't have that policy.