If someone got that email - check the email headers and the 'Authentication-Results' field to verify SPF/DKIM/DMARC alignment. If a domain has a DMARC policy of 'p=none', a forged "From" field will not be rejected-it will land in the inbox and look completely genuine.