First, let's define something:
change.org is a domain name.
example.com is a domain name.
something.example.com is a subdomain (
something) under a domain name. You can think of it like an address where you say the house number, then the street, then the city, then the country. And sometimes you can omit some details from the address, so not every domain needs a subdomain.
Emails from completely different domains could also be legitimate emails. There are some companies that have a domain just for email and one for the website domain.
Some even use separate companies to send emails.
Both of these practices can make it very difficult for people to determine which email is legitimate and which is fake. Most companies are trying to make it easier for people by using the same domain.
What makes an email source legitimate is the intent of the company. And if a company makes that intent unclear, it creates confusion. People end up contacting the company to confirm that the email is legitimate. (and if you do, ask the company to fix the confusion they created).
This email, however, isn't really doing anything strange. The subdomain name is from the same domain that no one else shares. So,
would all be the same "place". This gets tricky, however, if the domain is shared with lots of people, but for Change.org, it's just them.