The researchers said it is a common feature used for inbound emails only, but somehow the hackers were able to send messages out using the exact address. They gained control of a Salesforce-generated email address by creating a new Email-to-Case flow and then verified it as an "Organization-Wide Email Address," with Salesforce's Mass Mailer Gateway using the address in the official outbound flow. The hackers then used that address to verify ownership of the domain name.