@mtepp ...
For clarification, do you know for certain that the student sent you the message via her Canvas Inbox? A student cannot compose a brand new e-mail message to you outside of Canvas (using something like Gmail, Yahoo Mail, Outlook, etc.) and send it as a message to you in Canvas. However, if you had previously sent a message to this student via the Canvas Inbox, and she had her own Canvas notifications set up to receive a copy of your message to her own e-mail account, she would be able to reply to that e-mail message (using her Gmail, Yahoo mail, Outlook, etc.), and it would send you that message to your Canvas Inbox.
You are correct, though. If a student is truly only using Canvas and the Canvas Inbox to message you (not using Gmail, Yahoo mail, Outlook, etc.), then it seems to me the student would need to first log in to Canvas in order to use the Canvas Inbox. So, that seems a bit fishy to me, to be honest.
I don't know if any of this helps, but it's my $0.02.