The convenience of having the first email in "claim" the inbox sounds nice, but how do you stop bad actors from claiming other genuine businesses before you've done business with them? ex., one fast food company spamming all of their competitors' names for your accounts?

What's the difficulty in letting someone manually add more domains, or replace the existing domain explicitly without going through a "release inbox, and the next email can claim it again" dance?

I really like this idea, but only in theory right now.