We do have several solutions in place for that, though. SPF, DKIM, among others. If this University were running on gmail I suspect this email would have been f

We do have several solutions in place for that, though. SPF, DKIM, among others. If this University were running on gmail I suspect this email would have been flagged for phishing (the builder did publish an SPF record), or outright rejected. However they run their own email servers[1]. [1] - They could of course do the same checks and even more, but among self-hosted installs it is common to disregard those additional securities.