Anyway they should configure their systems to reject unsigned e-mails and providers that don’t have a proper SPF configuration. SPF (Sender Policy Framework) allows you to make sure that the message was sent by an approved server and was not forged by some hackur.

Their site is just a landing page, there’s no login option or anything like that. Their business is a smartphone application.

Edit: Gmail uses SPF, DMARC and DKIM signing so spoofing is not possible if their email services are configured properly.

For now, I do not want to announce the name of this company publicly.

If they don’t want to solve it amicably, then I will do so.