“Of these, MAIL-FROM has long been considered insecure, for the simple reason that it’s not difficult to spoof the return address of an email.”
Lumen’s routing registry accepted changes by email and checked nothing but the From line. The contact addresses for every network are public. A forged email could have pulled routes for banks, telcos and government agencies. The backbone of the internet trusted the one header anyone can fake.