So if Apple applies those things to authentic emails from the iTunes store (receipts are the context in my dad's case), then how in the living goddamn fuck are

So if Apple applies those things to authentic emails from the iTunes store (receipts are the context in my dad's case), then how in the living goddamn fuck are Apple permitting obvious forgeries through to an icloud.com account? I find it really hard to believe they're either malicious or incompetent, so what's the alternative explanation?