Sorry. I’m exceedingly lazy, and not a very talented Rails programmer and always look for solutions that don’t involve changing Discourse. (No, that’s not being sarcastic. I recently started a conversation to write a $1000 plugin and talked the non-customer into a solution using only existing features.)
Without looking at the code, I think that it might be possible to remove or relax the code that checks the sender From: address, as I think it’s the case, as you suggest, that the token is unique and that if you don’t care that someone might get that token some other way (say a forwarded message?) that you could override process_destination in a plugin and allow those replies to be delivered with the understanding that it’s something of a security risk. I think you’d need to just change this:
to something that either allowed any address to reply or maybe did some kind of “is it close enough” logic that I can’t see now how you’d come up with (not to say that one couldn’t).