Deleting the message your side does not delete it on the vendors side. I wouldn't be to concerned, sounds more like this vendor isn't running a very tight ship, just take it through the resolution process accordingly. If you wanted to be extra cautious and suspect this vendor has been compromised then you should of course clean house though.