Sadly these spoofed emails from high ups are becoming all too common.
Shameless plug - if anyone is in need of an open source phishing training solution, I recently launched gophish to great feedback so far, and have a new version being dropped early next week: https://getgophish.com.
Everyone should have access to training to prevent this as much as possible.