I mean, the volume is absolutely an issue but it looks like they failed to configure DKIM/DMARC/SPF and this is a lazy policy end run around a gap in technical knowledge. I'm not surprised, but it is a bit amusing.