You could ask the user via email to send some small, but "unique", amount of bitcoin from that same address again and then refund it after you've verified that the person emailing you is indeed owner of that bitcoin address.