In this case, the email validation appears to happen server-side, not client-side via JavaScript. The provided email is sent to a backend API, which determines what happens next, making the ...

their email address is checked against the attacker’s database, via JavaScript-based validation scripts on the page, before the fraudulent credential stealing login form is displayed.