Sorry, still not clear to me. - Whom the would-be attackers send this email to? - Do they send this email from their own email address? - Is there an assumpt

Sorry, still not clear to me. - Whom the would-be attackers send this email to? - Do they send this email from their own email address? - Is there an assumption that sysadmin/support team will blindly reset a password on someone else's request? - How do attackers bypass corporate VPN?