nope, the original diagnosis was right. appears the 'from' email needs to match a site user.

if true, this brings a question. i assume the restriction on emails is so the API cant be exploited. however, does this mean any site user could in theory send out emails that appear to have been sent from any other site user? are there restrictions on who can be sending emails from who's email?