There was a case when employee A thought he was getting legitimate emails from employee B, as the email address was valid, there were no CC/BCC addresses and just plain text in the body. Some sensitive data was exchanged at the end and an outside email address was revealed for some reason at the end of the chain. Employee B never received and replied to employee A emails. Also, exchange server ended up being down after this incident. What could have happened? How can this be prevented?
Email was never designed to verify an email actually came from the person it says it came from. The model is largely one of snail mail, where it's trivial to print an address of President Of The United States as the origin.
The most likely scenario is the header address appeared as employee B, but the reply to: address was set to someone else like [email protected]. In this case, replies would go to [email protected] instead of employee B.