I've just read this again, looking for something that may have eluded me on the first pass, and I still haven't found it. So either it's not there, or I'm just not seeing it. (If the latter, I apologize for being dense.)
To wit: how does the site initiating email traffic know that the email address it's been given belongs to the putative requestor? ---Rsk
