umm.. he doesn't own the totalise domain, it's a rival ISP.
I'm also not talking about blocking return addresses that don't match the ISP, but incoming addresses that do match the ISP but don't originate from the ISPs mailservers.
Mytob (and bagle before it) send emails that claim to be from
support@isp.com or
administrator@isp.com etc with messages like "your account has been cancelled" etc. f
red@isp.com panics, tried to run the attached file then calls his ISP to find out why he was send this email and why the attached file wouldn't open. Totalise will get less of those calls as the emails will only get through if the person infected is also a Totalise customer.
There are flaws in the system as Digidragon discovered, but to me it makes a lot of sense. And if anyone complains Totalise can just say "well, why are you trying to use a totalise email address if you're not using our service anyway?"