forex.pm forex forum binary options trade

Let's assume that I have small crypto exchange site called "MyExchangeWebsite".
It works like this: user creates ETH-BTC order, specifies his BTC address and sends ETH to my ETH address, I exchange it on Bitfinex and send resulting BTC to the specified user's address. Site is very simple and doesn't have accounts (non-custodial model).

By some reason user made a one-character typo in his BTC address for ETH-BTC order and it's impossible now to withdraw BTC, as checksum is bad. User noticed that he didn't receive BTC and contacts me to provide right address.

1. Am I right in my understanding that it's safe to change user's address and it's impossible to scam MyExchangeWebsite by third person who knows about typo and user's order details?


2. If it's not one-character, but N-characters typo. At what N it becomes unsafe to change N characters in user's address?


3. What is the best way to make sure that I'm in contact with the real order creator?