The References header is an ordered list of mails, and some clients
only look at the last mail in the list to determine to which mail the
mail is in reply to.
Therefore, to be a less obtrusive as possible, put the fallback
address first.
Some info about the reply key lookup in the References header:
https://docs.gitlab.com/ee/administration/reply_by_email.html#how-it-works
There are several quick actions now that don't need this access - /todo and
/unsubscribe for instance - but when these were first added, there
weren't. Quick actions are now responsible for checking their own permissions.