I'm not really an expert on this, so I don't know why someone is doing this here, but it sounds like a DKIM replay attack: https://proton.me/news/dkim-replay-at

I'm not really an expert on this, so I don't know why someone is doing this here, but it sounds like a DKIM replay attack: https://proton.me/news/dkim-replay-attack-breakdown https://proton.me/news/dkim-replay-attack-breakdown