"Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounces+1604765-1070-timeofmind=gmail.com@em.coinbase.com designates 50.31.37.137 as permitted sender)"

Either coinbase mail server was used, or the their DNS server was accessed and SPF record altered.