Substitution of the sender, how?

Question

SPF

Spf is configured on the mail server.
In the logs, I see that the sender is [email protected], and in Outlook, the user's Corp account is displayed, how is this possible?

Answer 1

there is MAIL FROM during the smtp session - and spf is checked against it,
and there is a From: field in the body of the letter.
To prevent your domain from being spoofed - configure spf dkim and dmarc

Answer 2

because the letter has a "from" field and mail servers generally don't care who it is from.