See questions 40/41 http://www.ftc.gov/privacy/coppafaqs.shtm#teen
""" 40. I operate a general audience site and do not ask visitors to reveal their ages. I do have a button that users can click to send feedback, comments, or questions by email. What are my responsibilities if I get an email that says, “Hi, I am Steve, age 10, and I really like your site. When do you think you will add some more games?”
Under the Rule’s one-time contact exception, 16 C.F.R. § 312.5(c)(2), you may reply to the child once without sending notice to the parent or obtaining parental consent, if you do not re-contact the child, and you delete the child’s personal information, including email address, from your records after responding to the email.
"""
Legal Corollary of 40: If you send spoofed email to a site operator claiming to be under 13, you could legally force them to delete another user's account.