That's an excellent question, and honestly, I am not sure. I know we have been asked to send invoices not attached to a customer order AND only one listing was taken down (as opposed to the entire brand), so perhaps it's all suppliers that have contributed qty to that pick location go through a similar different workflow? While I know they have the audit info to do this, I am ultimately guessing on this scenario.
While I know plenty of companies do not respond how I feel they should to vulnerabilities, reading that story I don't see any cited anger from United Airlines.
The article has some user comments I found relevant I don't see pointed out here.
"That change was actually made a year ago. The only change on that page is the positioning of the video. The actual text has not changed in over a year."-Barry Schwartz
I thought that may be the case but reading about synchronous communication through the queue and a desire to keep the architecture simple with a single api was causing me doubt.
Perhaps I am not following 100%, but I believe we have done this without this issue for years with google apps.
We have one primary domain and 15 alias domains.
Email Example: [email protected] gets an email, when they reply it stays set to the alias, it doesn't change to the primary domain.