The loophole allows spammers and scammers to send emails from a legitimate Microsoft email address typically used for sending genuine account alerts.