[nip180]

That greatly increases the level of sophistication.

The article doesn’t say that the emails received were “@harvard.edu” only that they appeared to be valid Harvard ids. That means she made a judgement call that the email were legitimate, but it doesn’t give very many technical details on what she judged that call on.

[InitialLastName]

This makes me assume that the bits she's most embarrassed about (a fact-checker should be able to find out what the valid Harvard email domains are) are the one she glossed over.

[nip180]

I don’t think this article was written for a technical audience so it’s not surprising that it’s light on technical details.