All emails get automatically forwarded to the IT department, for “suspected phishing”. If it is from a known internal source, especially so.