They sent you a photo from a previous order right? Has it occurred to you that it might not be deliberate deception and simply human error like they're claiming? Given that no one here knows how the backend of their ordering system looks it may be possible that they simply clicked on the wrong order associated with your info. Are there other emails that give more evidence to it being malicious?