You don't need a dongle, backend sql db or infact anything to send a forged email but just a terminal on linux would do.

The company should have investigated if he did or didn't send the email