Sorry about the delayed response, I've been away.

Yes, that's the million dollar question eh? I would add an additional field
to the customer table with the customer email address
OR
Inform each client of their ID/account number and force them to give it to you in their email order each time. As a double check I'd make them give you their company name
EX:

Subject: Company: XYZ Company, ID: 12345

You can parse the subject line and split it into Company and ID. If both can be found in one record you have a match; otherwise you could reject the
email & print out a errors list automatically.

I suppose if it's always the same person ordering then the lookup could simply be their email address.

Personally, I'm a believer in making the customer shoulder as much of the responsibility as possible.

My system always has an email address, their name & business address.
I use a combination to determine if they are an existing customer or new.
The client set up the business rules.
I dump the whole message into a memo field and parse it for the info we require.

I hope this helps and is on time...