So many companies send emails with multiple different address. For example, Citibank could send from [email protected] or [email protected]. Bank of America can be [email protected] or [email protected]. If the "Citibank inbox" just takes the first address that Citi happens to use and auto rejects all future others, user will lose critical emails without even knowing. There is no way either user or the app could guarantee an entity will ever only use one address for legitimate reason.
Ah, but Clova handles that. It locks to the domain, not the sender or the subdomain. So both your examples would still be allowed (citi.com and bankofamerica.com). There are also permanent inboxes in the system, which allow anyone. The trick is to delete them after a while when they get polluted with spam.