So they can say what they like about people in an email? I guess that’s why they do it then. They’re lawyers will have said it’s ok.
Surely that goes without saying? In private correspondence you can basically say whatever you like (obvious exceptions apply such as threatening to kill someone or abusing them racially for example) as it is private between two parties. I don't see how it can work any other way to be honest! Northern's statement was clearly unwise (as has been said far better to include a generic paragraph at the bottom of the email warning about fraud) but I don't see why they can't say it and I certainly can't see how it would rise to libel or slander.
If Northern had said on their Twitter feed "Passenger X had their delay repay claim refused on suspicion of fraud" then you'd have case (probably multiple actually as I would imagine that would be a data breach as well) but in private email? Not a chance.