Neat. It sounds like this extra step prevents a situation where, for example, a dev's server-side database gets hacked and the users' relay e-mail addresses are

Neat. It sounds like this extra step prevents a situation where, for example, a dev's server-side database gets hacked and the users' relay e-mail addresses are exposed. The attacker wouldn't even be able to send e-mail messages to the users. He'd also need to compromise the registered domain's mailservers, or their DNS servers (to modify the SPF records), or their Apple dev account to add their own registered domain.