Let us introduce you to sender spoofing...

Look at the email raw data. Not what the client says.
You can put a from address of anything you please if there is not full checking.

That's clearly the flavour of the month to get people calling the call centres now that the baiters make more people aware. Got 5 in my gmail trapped spam yesterday