3 ms·

Presumably they could require that the from address is one your authenticated user is allowed to use, right?