I’m minimally knowledgeable in this.

They plugged in an email server that was so badly configured that it bypassed the federal email/spam filter to deliver spam to anyone, and they expect users to just trust they haven’t similarly fucked up on anti-spoofing measures?

We’re almost certainly going to see screenshots of spoofed emails from that address.