> Imagine if there wasn't quite enough security built into all of this.

Fortunately, it seems that security was a consideration. From the Ars Technica article: At one point, the callers' email was asked for and Duplex responded with "I'm afraid I don't have permission to share my client's email."