Simply check the. last two parts of the address, if it is anything.ba.com it is legitimate.

Bad actors can't use the BA.com part of a return address, that's why they often try to hide behind a bit.ly short address or something like ba-refunds.com