The address "company@example.com" doesn't point to a subdomain, though, the only reference to the company is the local part of the address, and so has nothing t

The address "company@example.com" doesn't point to a subdomain, though, the only reference to the company is the local part of the address, and so has nothing to do with DNS. If he said he used "joe@company.example.com", then it's possible he has a wildcard MX record for *.example.com, but that's not at all what he said, although perhaps it's what he meant. Regardless, the question remains unanswered.