Huh?

An LLM can be trained to actively check that every email comes from a domain controlled by the claimed author of the email. That DKIM signing was successful from the purported issuing domain, and so on.

All of the stuff I do when grandma calls asking whether an email is legitimate.

We should have LLMs trained powerfully in detecting signs of these attacks -- after all, we have literally trillions of training examples stored!