Safest way to validate typo

Question

Let's assume that I have small crypto exchange site called "MyExchangeWebsite". It works like this: user creates ETH-BTC order, specifies his BTC address and sends ETH to my ETH address, I exchange it on Bitfinex and send resulting BTC to the specified user's address. Site is very simple and doesn't have accounts (non-custodial model).

By some reason user made a one-character typo in his BTC address for ETH-BTC order and it's impossible now to withdraw BTC, as checksum is bad. User noticed that he didn't receive BTC and contacts me to provide right address.

1. Am I right in my understanding that it's safe to change user's address and it's impossible to scam MyExchangeWebsite by third person who knows about typo and user's order details?
2. If it's not one-character, but N-characters typo. At what N it becomes unsafe to change N characters in user's address?
3. What is the best way to make sure that I'm in contact with the real order creator?

Answer 1

1. If user sends BTC to an address for which he does't own private keys, its not non-custodial.
2. Most of the websites that do such crypto-crypto exchange ask for a refund address in advance and other issues are solved depending on the case.
3. Best way to verify things without KYC is by asking the user to sign a message for one or more bitcoin addresses that he used earlier. Example: Someone sent me 1 BTC and I need to verify in an email communication that he is the same person, I can ask him to sign a message using bitcoin address that was used as input in the transaction.