My first vulnerability – Mimecast Sender Address verification

I want to start and say this was something completely new to me, my only other previous security research experience was something a coworker noticed and I helped report. So what went wrong, to me the backstory is pretty interesting.