[manmal]

Or just pretend that you are a gmail mail server and store the credentials that are transmitted when people add the account to their mail app.

[dbbk]

Would DMARC not prevent this?