I don't think is "compromised".
This is a regular pathetic phishing intent.
Look into the email header (not just at "from" field). You will see that originated server is NOT any authorized sender.
Anybody can do this pathetic phishing for any domain, putting any email address in the "from" field.
You email server and client mudt be configured to check and reject these fields based on SPF and DMARC records.
Guys, please do not spread false info if you fon't know how emails works.
