You can see in the screenshot (scan of the email) it was a low-tech spoof. They simply bought the same domain with a different TLD (.com vs .us)

There were many red flags that weren't caught, this being one of them.