Comment by Thorrez

The spoofed address was appleid@id.apple.com . support+id@company.com was the to address, not the from address.

https://gist.github.com/hackermondev/68ec8ed145fcee49d2f5e2b...