So, the company I work for gets a lot of email spoofing attacks. How these typically work is by injecting into the header a false "reply to" line. So, if you hit "Reply" you'll be directed to someone like this guy, James **** <ceo19000@gmail.com> but the email will show as being from your companies CEO.
A specific example from earlier
So, while I work out email policies to fight these within Office 365, Ive decided to have some fun. Specifically, starting out with ceo19000@gmail.com. I will of course update the OP as something happens (if it does). But, I want to waste th