.gov is a US thing, and not even all US agencies use .gov ending emails.
You do not need to compromise anything, you can put any address in the "from" field. Email has no universal verification for sender address.
I would sincerely hope .gov addresses use SPF/DKIM/DMARC. That makes spoofing impossible. In Revolut's case, the sender's email system had been compromised.