harvard.edu doesn't have a dmarc policy so it can be spoofed.

edit: nevermind I've read the other replies and it's not that easy