At first I thought it might be by turning the email into an image, but when I scrolled down and saw the encryption part I realized they probably do some sort of token validation with their server to decide whether to decrypt the message.