plenty of companies have mailing lists which are listname@companydomain.com

Getting on those lists is often easy. Same with support ticketing systems, etc.

Someone else on the list might figure out something was fishy when the verification email came through though.