Sorry, still not clear to me.

- Whom the would-be attackers send this email to?

- Do they send this email from their own email address?

- Is there an assumption that sysadmin/support team will blindly reset a password on someone else's request?

- How do attackers bypass corporate VPN?