In my experience, if I forward an email to the sender's spoof@ address they will contact me if it is actually legitimate, in part because they want to understand why I thought otherwise.
Mostly the infosec team want to arm themselves for when they go lecture the marketing department (or whoever) about their bad security practices.
