"then how do we know that the e-mail is legitimate?"