Safest way to validate typo
If user sends BTC to an address for which he does't own private keys, its not non-custodial.
Most of the websites that do such crypto-crypto exchange ask for a refund address in advance and other issues are solved depending on the case.
Best way to verify things without KYC is by asking the user to sign a message for one or more bitcoin addresses that he used earlier. Example: Someone sent me 1 BTC and I need to verify in an email communication that he is the same person, I can ask him to sign a message using bitcoin address that was used as input in the transaction.