It's def possible, but even if that were the case, I'd still be nervous about clicking on the email links. Given the lack of tools for dealing with this issue, I'll assume Google/Facebook haven't seen this problem in a large enough scale yet.