Spoofing emails is really really easy but like others have said modern security like DKIM makes it easy to spot. Most email providers automatically put emails in spam if the headers don't match or are absent.
Discussion
They didn’t spoof, it was a real email from Coinbase, and someone else with my email sending an email change request