Comment by refurb

I'm curious how the email attack worked, don't most web-based email services flag emails that come from one domain, but contain a link to another?