[zwily]

To phish via SES, you'd have to get coinbase.com as a verified domain, which mean you'd need DNS access. I assume the same is true of other email providers.