The attack doesn't work on hey mail, since new senders have to be accepted before they go the inbox. Presumably Google or whatever is already whitelisted and just goes through