You just verify that you have access to an email address that belongs to a company (@example.com) by entering a six digit code they send to your work email. This in theory verifies that you work there, but obviously nothing else like your actual position at the company.
From an attacker standpoint, if an attacker gains access to any email address with @example.com, they could pretend to be the CEO of example.com even if they compromised the lowest level employee.
