If you send an email to an address that you find in the SOA, you are not, technically, validating control of the domain; you are validating control of that specific email address. Which is not the same thing.
To really validate control of the domain, send a challenge to the purported domain owner: make him create a new entry in the DNS, e.g. a TXT field, or a custom CNAME. If the requested entry appears, then yes, your interlocutor appears to be in control of the domain. As for any challenge/response protocol, the challenge ought to be unpredictable (i.e. the custom CNAME should include a big random name element).
Email addresses in the SOA are not necessarily up-to-date. Most SOA have this address because it is part of the format, but it is rarely verified so I guess that many domain have an incorrect address there, or an address ending in a mailbox which nobody looks at. In any case, I don't think that many people consider that putting this address in the SOA constitutes a delegation of power over the domain to the individual who would happen to be able to read emails sent to that address (especially since emails are not exactly the most protected communication system ever).