Exactly. No concrete details and examples so safe to assume the emails were not actual @harvard.edu ones. But I blame it on organizations and esp universities. Each school/lab get their own prefix which makes it harder for people to spot a fake address.
> to assume the emails were not actual @harvard.edu ones
If that is so... so what? Plenty of organizations use different domains. Fidelity staff uses "frm.com"-- as an example-- while most customers know them as fidelity.com.