Yes, it possible . Sending email from *@ogranization.org without having access to the domain is a type of attack popular called email spoofing ,
There are a lot of case where victim will targeted sending email seems
to be from the valid domain with malicious virus ,RAT but they are
,So most of the time spam filter engine of the email provider will detect it but there are also ways to make it undetectable. So only a easy way to detect check out the ip headers of the sender if it match the ip of the real organization and alot off parameter which can help find it is fake here a example of header info OR You can check it out at
for <firstname.lastname@example.org>; Tue, 6 Mar 2012 19:27:05 +0700
Subject: Your Intuit.com invoice.
**X-PHP-Script: intuit.com/sendmail.php for 22.214.171.124**