I agree with you for 99% of cases but there can be unexpected domains in the mail, or more interestingly, having your data sold. If hyperrin-nexflux2@port69 starts getting random spams for example, then you have a good idea who fucked up