SMTP never authenticated the From field, so writing any address there costs an attacker nothing. What normally stops this is the receiving side checking SPF, DKIM and DMARC alignment against the header domain. Policy is the weak spot: p=none files a report and delivers the mail anyway, and a week-old lookalike domain has no reputation to lose. Most clients then show the display name and hide the address behind a click. With that screenshot, open the raw header and read Authentication-Results. Passing DKIM for the real domain would mean their sending infrastructure was abused. Missing or failing signatures mean plain forgery from a throwaway domain, and then the right target is a blocklist entry and a DMARC report rather than a breach investigation.