I had a similar thought: I would be more and more suspicious the longer I didn’t get an email from an @harvard.edu email.
At some universities, it’s possible to create email aliases at your .edu domain, so it’s possible that the scammer had access to one or more convincing email addresses.
The article doesn’t say that the emails received were “@harvard.edu” only that they appeared to be valid Harvard ids. That means she made a judgement call that the email were legitimate, but it doesn’t give very many technical details on what she judged that call on.