Actually they did.  What they likely figured is that nobody would really
want their end users to look through miles of headers to figure out if every
one of the 700 + messages they received that day were legit and likely
assumed that most users wouldn't know the names of the legit servers anyway.

Instead, they made it more noticeable in the from line of the message header
by putting the users SMTP address next to the name if it did not originate
locally to the system.  So if you send via SMTP, you'll see it with the
<name>[smtp:address@here.com] format vs. friendly name you see in the GAL.

I'm interested in knowing a user population that looks through every header
before figuring something is legit vs. using something like PKI to ensure
the legitimacy of emails.  That's also possible with OWA 2003 FWIW.

Thoughts?