Hacker News Reader

If I'm reading this right, the recipient has to be a mailgun user, and the sender has to be another (yet spoofed) mailgun user.

The sender can be anyone. They don't need to be a mailgun user.

The recipient has to be a mailgun user, yes.