Folks, we ALL need to be technically "woke" and understand that spammers are entirely able and willing to fake the return addresses of emails they send. This is a huge industry. This happens A LOT. You simply can't assume that an email is really from who it appears to be from. They are hoping you will respond and relax your guard because you think you know the sender. As manager of the mailing lists, I can't tell you how many times the entire contact lists of our members have been stolen, and spammers have begun to post to the lists with faked return addresses.. Many times I have had to mark a member as requiring my moderation so that the spammer's posts don't get through. Usually the spam dies down after a few weeks and I can clear the moderation flag.
Of course I don't know if the email Seth refers to was faked or not, since I haven't seen it. It's usually pretty obvious.
I generally consider this kind of "meta talk" about email, security, etc to be off topic, but since this has come up, I thought I should respond.
Tim