think the messages truly came from Disney, and then echo the emails with all the correct security signatures added to the spam recipients. Why would Proofpoint allow such a thing to happen?