Chipotle has been replying to job applicants using a domain they do not control

krebsonsecurity.com