The address "[email protected]" doesn't point to a subdomain, though, the only reference to the company is the local part of the address, and so has nothing to do with DNS.

If he said he used "[email protected]", then it's possible he has a wildcard MX record for *.example.com, but that's not at all what he said, although perhaps it's what he meant.

Regardless, the question remains unanswered.