> Those two requests utilizing government agency-internal auth mechanisms we do not need to know or care about.

Most likely:

> and the whole thing was PDFs from .gov-ish email addresses

But I guess this moves the liability for answering fake requests to the local branch.