Scam email from do-not-reply@ses.binance.com. How do they do that?

Hi.

I received an email from do-not-reply@ses.binance.com saying:

Dear user,
You are trying to reset the password linked with your Binance account.

|| || |Device: Safari 16.6.1 (Mac OS X) IP Location: Bucharest Romania IP: 178.132.108.236|

etc etc etc

I am from England.

A short time later a youngish male with a southern English accent called 'Ryan' rang from a Private Number saying he was from Binance support and that my account had been hacked. He referred me to the email. Now the email is definitely from do-not-reply@ses.binance.com (I viewed the raw source of the email to check) so I decided to go along with it but not give anything away. His explanation of how I was hacked was not very convincing especially as I could see I still had access to the account and the balance was still the same. He said he was compiling a report for Binance and to pass it on to other exchanges I had accounts with. He asked me if I had other accounts. I was very dubious about telling him this so said I would if he rang me back in half an hour.

I only have one other account on a different exchange so went there and changed password, removed old devices and secured it as much as it was possible to do.

He rang back. I told him the name of the Exchange. He left with a number for the Report he was passing on to the other Exchange. 30 minutes later I get a call from a woman with a London accent, again on a Private Number. She says she is from the other Exchange and asks me for the number. I am now 100% sure it's a scam so tell her I will contact the Exchange directly and close the call.

I am a bit rattled as I thought I was pretty savvy to this stuff but the fact the email *is* from a server within the binance.com domain had me fooled. I did not think it was possible to do that.

So, big question: How can a scammer possibly send an email from do-not-reply@ses.binance.com ??

And here's part of the source of the email to prove I'm not going mad:

ARC-Authentication-Results: i=1; mx.google.com;

dkim=pass header.i=@ses.binance.com header.s=gxhqvjfn7nxg45wwesxakydswcc4dbhb header.b=MwlDvzaH;

dkim=pass header.i=@amazonses.com header.s=ihchhvubuqgjsxyuhssfvqohv7z3u4hn header.b=UFDqYrmY;

spf=pass (google.com: domain of 0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com designates 76.223.149.163 as permitted sender) smtp.mailfrom=0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com;

dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ses.binance.com

Return-Path: 0102019aeadca385-cd44d6a7-a0e5-4c3c-b15e-5b758a55c132-000000@aws.ses.binance.com

Received: from c149-163.smtp-out.eu-west-1.amazonses.com (c149-163.smtp-out.eu-west-1.amazonses.com. [76.223.149.163])

by mx.google.com with ESMTPS id 5b1f17b1804b1-47930ca6365si13442465e9.74.2025.12.04.11.35.20

for me@me.me

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Thu, 04 Dec 2025 11:35:20 -0800 (PST)

Any input would be appreciated (apart from any calling me a fool. I know that already).