Note

They can change the forwarding address at Gmail/Outlook fast enough that for every e-mail that comes in, they just forward the last hop to a new victim.

Seems easy to stop, just rate-limit forwarding address changes at Gmail/Outlook. Or require validation from the address being forwarded to?