I've just read this again, looking for something that may have eluded
me on the first pass, and I still haven't found it. So either it's not
there, or I'm just not seeing it. (If the latter, I apologize for being
dense.)
To wit: how does the site initiating email traffic know that the email
address it's been given belongs to the putative requestor?
---Rsk