Consider a determined attacker. A posted signed letter has zero cost and is easily forged and a phone call is free via Skype. There's plenty of low-tech ways to circumvent security.
How exactly does Skype let me take over a business's phone number? I am saying that SendGrid should call the company to verify, not the other way round.
