No idea on harvard, but alumni are often allowed to keep their addresses and for every alum that still takes full advantage of that, ten may not notice anything. Similarly, old group addresses may mostly go into the void.
I suspect it is quite easy to make it look like many people from an institution are in a thread and a passive participant is an email address from a 3rd party job portal.
I don’t know a single reputable U.S. institution that doesn’t replace your @university.edu address with @alum[ni].university.edu after you leave. I’ve been affiliated with two and have friends all over the place, including Harvard.
For decades, Harvard issued alumni email addresses of *@post.harvard.edu. [1] Given that “post” could either refer to “after” or “postal”, I would imagine someone who didn’t know many people at Harvard might think that a post.harvard.edu email address is a normal thing for current employees.
MIT uses @alum.mit.edu. I don’t think I know former employees there but at least former students I know lose mit.edu addresses, a fact also easily confirmed with a Google search. So, your point being?
Edit: You added
> *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture?
after my reply. I’m not sure how it is relevant to your claim that “alumni are often allowed to keep their addresses”. In fact the question doesn’t make any sense to me; I’m not gonna accept an MIT job offer from an alum.mit.edu address (or more relevant to me, alumni.stanford.edu/alumni.princeton.edu), regardless of network culture.
Edit 2: Reread your question and realized you were implying that MIT "recently" allowed alumni to keep @mit.edu addresses. Well, you'll need to show some proof.
Your expectations are very specific to what you know about US schools right now. MIT would let a machine receive email, many institutions would forward email to a users alum address, etc.
This approach to identifying phishing is ultimately insufficient.
They've gotten pretty good at crafting domains this way.