>That's not how it works in the real world. That would be a fraudulent request and I suspect they'd invite legal trouble by impersonating someone else to access a computer system.

Emails are not people. You can impersonate a person, but you can't impersonate an email. If I own a company and I issue the email dick.less@privateequity.com but then have to fire him... using this email address to transfer company assets back to someone who can be responsible for them isn't fraud (for that purpose, at least). How is this not the same issue?