Surely they'll only allow that if they pass the auth and the domain belongs to your account?
Fixing this would only affect users who send emails "from" other users email addresses, basically users who commit fraud.
Surely they'll only allow that if they pass the auth and the domain belongs to your account?