So you think he had access to Viva's email servers to see the response? No, he clearly tested it himself and used his credentials to send it.

The log line is from Google Workspace which exposes it to its customers for incoming mail