Good question!
I sent them en-mass from the official public Haiku, Inc. email. Gmail requires outbound smtp emails to come from gmail.com (and will even go as far as modifying the from address to ensure you aren’t spamming from them).
I could of sent it from baron/maui directly on haiku-os.org, but GDPR best practices dictate that communications around data security incidents come from official channels of the corporate entity.
I also wanted to ensure delivery occurred and the emails didn’t get flagged as spam since they’re pretty important… gmail has a good track record of not getting classified as spam.