Sending a reply email message can still work just fine. Assuming they include the original message in their reply, you just need to embed an ID in the original message, and look them up through that.
the majority use case here is that they're not malicious, merely spammy with good intentions.