> The attacker spoofed the “From” field ... On iOS, Gmail doesn’t let you view full headers, so I had no way to double-check in the moment.

Is this a victory of Google's UI designer's quest for a "clean look", over basic security essentials?