> My takeaway is that his test email bounced

What test email? I see no mention of a test email in the blog post. The mail that bounced was the one with the verification link from Viva.

So you think he had access to Viva's email servers to see the response? No, he clearly tested it himself and used his credentials to send it.

The log line is from Google Workspace which exposes it to its customers for incoming mail

Thank you! I added a screenshot of the Google Workspace Admin log screen... just becuase.