Yes you are right, but, the client does not do it on purpose. The entire process creates via internal mechanisms of the system, from which the client sends an e-mail.
Then I think that you have a big problem and I cannot think of a work around for random email addresses.
I suppose that you could disallow the use of email, and make everyone use the UI to open, update, etc tickets.