From what I understood you can sign-up at zendesk with any email like ooga-booga@gitlab.com and if someone sends an email to that address the email starts showi

From what I understood you can sign-up at zendesk with any email like ooga-booga@gitlab.com and if someone sends an email to that address the email starts showing up in the support software even before you verify your support desk account (probably because the company has configured the MX records to send all email to zendesk, etc). So now that you are effectively able to read emails sent to arbitrary address at the company's domain, you now get access to SSO links, etc sent on it too. Is this what the hack is?