Hacker News Reader

The header says that it's from vistomail.com. It doesn't have to be satoshi@vistomail.com.

The header indicates that it was sent via webmail.

Assuming vistomail.com is not compromised, then that indicates it was in fact sent by satoshi@vistomail.com

(I'll also note that they do not appear to expire registrations ever)