It's seems that it's a PHISHING e-mail...
It's difficult to understand why you have this, because phishing may vary in techniques...
It may be:
- usenrname spoofing
- SPF not well configured
- User hackered
- and so on...
You need to verify your logs.
If you aren't able to analize it and find the issue, you can hire an expert that can do that for you.
Gabriele Maoret - Head of SysAdmins at SERSIS
Currently manages 6 SmarterMail installations (1 in the cloud for SERSIS which provides services to a few hundred third-party email domains + 5 on-premise for customers who prefer to have their mail server in-house)