That’s true, but the rest of the headers meant the mail came from a legitimate source and was signed with a legitimate key. So they must’ve been compromised in some way.