So far it seems that a the "sender" field in the email is enough.. I suspect they would do it with a reply-to: header as well so yes many are probably leaking i

So far it seems that a the "sender" field in the email is enough.. I suspect they would do it with a reply-to: header as well so yes many are probably leaking in this way. It's a bit different for the companies that operate using a SSN of course.