Headers have Stripe dkim=pass, and scam email makes it past Google's spam filters.