
Apparently they are going to a random address at a domain hosted by Gmail and there is a forward setup at Gmail to redirect it to an Outlook\.com address, which then forwards to my actual address. This way DKIM/SPF validate and they can probably bypass rate limits on PayPal->Gmail->Outlook. \