Technically the institution owning the domain could forge the identity of one of its members. In practice, the sender having the password and Duo push for an institutional AD or G Suite account is a pretty good assurance.