[atomt]

Another way to trigger a bounce would be to have the evil domain purposefully having strict SPF and DMARC policy set.

[gondo]

this depends on recipient's (WP admin) server properly validating SPF and DMARC