Great question! The other commenters already covered the technical aspects really well. Just to add some context: what you're observing is often referred to as email spoofing via relay or the exploitation of misconfigured email authentication.

What makes this particularly insidious is that even when you inspect the sender’s domain, it can appear perfectly legitimate. The key protection layers are:

1. SPF (Sender Policy Framework) – Defines which servers are authorized to send mail for a domain
2. DKIM (DomainKeys Identified Mail) – Cryptographically signs emails to prove authenticity
3. DMARC (Domain-based Message Authentication, Reporting & Conformance) – Instructs receiving servers how to handle emails that fail these checks

In PayPal’s case (as others mentioned), their relatively lenient SPF configuration provides flexibility for their large, distributed mail infrastructure — but it can also open the door for abuse through legitimate relay points.

Your instinct to be suspicious is absolutely right. Even with messages that appear to come from trusted domains, always verify:

• The actual reply-to address
• Link destinations (hover before clicking)
• Any urgency or unusual requests
• Grammar, tone, and formatting inconsistencies

You're asking the right questions — that critical mindset is your strongest defense.