someone hooked up their web app to Google Workspace email and the web app got pwned.

Google Workspace email is very generous with the kind of outgoing email you can send via their SMTP servers.