Not sure if this can get spoofed: smtp.mailfrom=noreply@mailing.trezor.io; spf=Pass smtp.helo=postmaster@mailing.trezor.io; dkim=pass (signature verified) header.i=@trezor.io; dmarc=pass (p=reject dis=none) d=trezor.io

The mailfrom field and others are set manually. I can send you a mail from what ever sender you want. The mail protocol is based on trust.