A tester finds an email address in a public job posting and a matching naming pattern on the company's website. What does that evidence support?

1. Authorization to access every employee's mailbox
2. Proof that every inferred address is currently valid
3. A candidate employee-address naming convention for authorized assessment planning
4. Proof that the organization has no phishing controls