Is the first validation token they received permanent?
No, the first validation token is not permanent. It is associated with the original order ID, so when the subscription renews, a new validation token will be generated with the new order ID.
What if, on renewal they change the email...