Unless harvard’s email severs were breached, this seems like a case of user error... Harvard.edu has SPF headers which should be enough to detect fake emails right away. If i’m not mistaken you’d have a really tough time spoofing those emails.