Understanding the tricky way that subdomain attacks use your email authentication against you.