With little effort, the security experts got three providers to accept a fake email. Admins should check their mail setup.