Isn't that email also used for any admin specific actions? Like password reset urls?
Ah, ok. That's the part I missed.
I would still be a bit worried about the security of it all if this were a big company though, but it's maybe doable for smaller ones?