It's almost certainly HMC accepting fraudulent email, not GMail. You get mail from "yourself" at HMC which then diligently forwards it to GMail, which trusts HMC to tell it about mail that "it" sent.