How do I convince senior management that email spoofing does not mean we were hacked?!

I'm a manager for a mid-sized non-tech organisation.
We get loads of spam emails but usually are able to block them through some firewall and quarantine rules.

Most phishing/spoofing attempts are the name and the 'from' email is still like a random Gmail account.
However, our Payroll team recently got a spam email where both name and email fields were spoofed and it seems like the email came from one of the senior managers. It was a request to change …

account bank block change cybersecurity email emails email spoofing firewall gmail hacked management manager managers name non organisation phishing quarantine random request rules spam spam emails spoofed spoofing team tech