It's harder for the user to tell that the email is from the right website, as opposed to checking the domain in the address bar. If i send an email from "Google" <passwordreset@gmail.com> with a password reset form, would people type their passsword and hit submit ?