i looked up their mx records, they use outlook as their email provider.

It should, then, be possible to spoof their own email address if you send from an open mail relay. spoofed address may look something like abuse@cancelthehate.onmicrosoft.com or something to that effect. it would look like an actual email from their own email server.

edit: this is not legal advise, and is only for educational purposes. or something, idk.