If you add a Contact element to the PunchOutSetupRequest, it must be after SupplierSetup, otherwise Dynamics 365 will give an error. However, according to the official cXML DTD, it must be after BrowserFormPost instead, see the error message for an example:

Element PunchOutSetupRequest content does not follow the DTD, expecting (BuyerCookie , Extrinsic* , BrowserFormPost? , Contact* , SupplierSetup? , ShipTo? , SelectedItem? , ItemOut*), got (BuyerCookie BrowserFormPost SupplierSetup Contact) Document does not validate against The cXML DTD

So to recap, the problem is that Contact element cannot be added without making the message invalid.