That's not really correct. CORS and the same origin policy don't protect against CSRF attacks by default, at least if we're using the standard definition of CS

That's not really correct. CORS and the same origin policy don't protect against CSRF attacks by default, at least if we're using the standard definition of CSRF attacks. An attacker can still "send emails on your behalf by making direct requests to your email provider's" HTTP API even with CORS and the same origin policy in their default settings, as long as your email provider doesn't implement CSRF protection (e.g. anti-CSRF token or Origin header checks). That's why all state-changing HTTP handlers need to implement CSRF protection.