Compromised Sending Infrastructure

The message was sent through a real mail server or email service admin account that an attacker had taken over. Email sent this way carries genuine sender details and can pass the checks that confirm who sent it.