Overestimating risk?

Am I overestimating the risk of telling someone that they probably shouldn’t solicit social security numbers over email? In this unique case, it’s important to note that none of the outgoing emails originate from the same email server of the recipient, so it has to go over the net.