Nobody breaks in. A door was standing open.
Some of those doors are on your computers. Others are in your email and your company's name.
Each door is one thing a criminal can use. Shut means it's set the right way and someone checks it. Watch them open one at a time, or pick any door. Some doors start with a message, a file or a call. The rest start by themselves, with no one needing to do anything.
Fake invoices in your name
The open door
Nobody watching what is sent as your company
Who keeps it shut: Whoever manages your domain, by publishing settings that tell mail providers to turn away mail that did not come from your real email service. We cannot see mail sent in your name.
The good news
Doors can be shut. On your name, settings on your domain and a second sign-in step close some of them, and a daily check shows you the look-alikes of your domain. Updates and the right settings close the ones on your computers.
The real question
Worth deciding: who checks the doors every week, on your name and on every computer? Having a named owner closes the gap.