Do you think this is still possible?
This isn't a problem for mail transport as the recipient is specified in the envelope and the message itself is not examined.
What a client should do in such a case is unclear. I suspect that they all use the first one encountered and ignore the rest.
RFC 6854 updated the From field to allow an empty group construct (see https://explained-from-first-principles.com/email/#no-reply) but mainly for other reasons (see https://explained-from-first-principles.com/email/#email-add...).
DMARC authentication either rejects multiple addresses in the From field or authenticates them all and applies the most strict policy (see https://explained-from-first-principles.com/email/#domain-ba...).
This isn't a problem for mail transport as the recipient is specified in the envelope and the message itself is not examined.
What a client should do in such a case is unclear. I suspect that they all use the first one encountered and ignore the rest.