I received the same email and, damn, the sender is actually Microsoft. Reality poor security management (as usual) from them. But the SPF record exists, so the scammer exploited something else.