The header indicates that it was sent via webmail. Assuming vistomail.com is not compromised, then that indicates it was in fact sent by satoshi@vistomail.com

The header indicates that it was sent via webmail. Assuming vistomail.com is not compromised, then that indicates it was in fact sent by satoshi@vistomail.com (I'll also note that they do not appear to expire registrations ever)