nomal user became fake user

[lvhannan]

i user zimbra server 8.6, today i got a problem ,one email is send said as follows:
VIRUS ALERT

Our content checker found
virus: Heuristics.Encrypted.PDF

in an email to you from probably faked sender:

claiming to be: <cm0001@abc.com>

Content type: Virus
Our internal reference code for your message is 25945-10/vgDP4lVwODdr

i check the history ,indeed that cm001@abc.com user send a email with attache pdf file , but i can not figure out why the server said this is a fake user,can anyone give me some help thanks