SPAM threat

Few questions,

Do you know if what is written belongs to you or the company?
Do you know the sender?
Could you please send us the header of the email?

FYI I haven't checked your attachment.

One word: scam. This has been going on quite a bit over the last year or so. Someone may have gotten his email address from either a list of previously hacked accounts (i.e. the LinkedIn compromise from several years ago) and is trying to scare him into paying money.

The email is spoofed (take a look through the mail logs to see my point), and your user should have nothing to worry about.

Do you have SPF and/or DKIM set up correctly? You should try to tighten that up so mail systems can know about unauthorized spoofs. Another idea is to have your mail filter  make it plainly obvious when messages are from the outside (my organization prepends "external" to subject lines).

Hi there! :)

You may want to introduce (more) spam filter policies to prevent such junk mail from coming in. Please refer to the link below for more information on how to do it.
https://docs.microsoft.com/en-us/office365/securitycompliance/configure-your-spam-filter-policies

You need to look at solutions to improve email security and use filter.

Configure manually SPF, DKIM and DMARC to protect against spam: https://techblog.exonet.nl/2017-02-03-spf-dkim-dmarc

Also, use "Have I Been Pawned" to check the breach status.

This is a good read for some tips and tricks to avoid email phishing attacks

This  page will be helpful for you to take the next action to block a similar issue:https://decentsecurity.com/#/malware-web-and-phishing-investigation/