If email is business critical, you do it. I work for a pretty small company and we do stuff like this. We have a sender tool that gives us a static sender IP, reports deliverability, click rates and at least estimates open rates. We also have a tool to estimate the quality of a newsletter sign up email address and not collect any disposable emails.

A small company will use a service like SendGrid, or even MailChimp at the higher level.

Those services will do a lot of checking for you and investigating this kind of weirdness/attack is exactly why you pay them money!

If they're sending directly, then they'll definitely be as vigilant as us, or they'd never get emails into people's inboxes!