There are two options:

1) He is using Windows and is not using Burp or ZAP proxy for modifying http requests. With Windows you can't use <>"= in a filename.

2) Gmail is handling emails from Google Analytics a bit different. (I don't think so)

To get around http://en.m.wikipedia.org/wiki/Same-origin_policy

> "By using the generated report from Google Analytics I could inject script code that was executed on mail.google.com"