Emails are sent via the Simple Mail Transfer Protocol. SMTP does not have a mechanism for authentication, so malicious actors often send emails using a spoofed "from" address to mislead the recipient about the sender of the message.