Good theory but not necessarily true. The attacker might still wish to use a spoofed domain to ensure that they get delivery of all replies.
In cases where Gmail and Office 365 accounts get hacked like this, the attacker will enable email forwarding to an address they can monitor for replies, and delete replies from the clients so that the compromised person does not see them. I am not sure if you can do this easily with a godaddy mailbox.
