suspicious new e-mail address notification of a contributer

[Oohara Yuuma <oohara@libra.interq.or.jp>]

I received an e-mail from a contributer of a Debian package I maintain.
The mail says his e-mail address is no longer operational and he has
a new one.  Because his work is an important part of the package,
it will be good to mention it in the changelog of the package.

The problem is that the mail is written in a way which makes me think
it is a spam:
* more than 50 addresses in the Cc: list
* the claimed "new address" is @yahoo.ca
* not GPG signed, no information about him in the body
If it is a spam, then updating the old address is wrong and responding
to it is not very safe.  I have no other way to contact him.
What should I do?

-- 
Oohara Yuuma <oohara@libra.interq.or.jp>

Lord, what fools these mortals be!
--- William Shakespeare, "A Midsummer-Night's Dream"