Welcome to the forums. 

It is likely that the message received was forged to look like it was an internal message.   Check the headers of the message, does it appear to actually come from the inside, or is there a history of traveling through various SMTP hops in the headers? 

It is is also likely that the link provided in the email, does not actually go to any resource internal to your domain.  It looks like a phishing email and a dangerous one. 

If this email did not originate from the inside, as I suspect, you can invest in a solid Anti-Spam product that should stop mail with forged headers from coming through.   

Good luck!

And be sure to send an email to all of your users indicating that they should not follow the link and educate them that it was a phishing attack.  All it takes is for one user to fall victim...

Welcome to the forum by the way.

As an aside...

I know a guy whose company did a phishing exercise. The goal was to see how many people clicked on the link and then educate everyone about phishing.

After the exercise they sent a follow up email telling users what to look for and that they should not have clicked the link in the original email. The original email was at the bottom of the new email.

The result? More people clicked on the at the bottom of the second email than the original email.

There is no patch for...

Funny you should mention it, because I recently commented on the eWeek article in this thread by our friends who are responsible for SocialPET:

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,4659.msg23036/

Good stuff by good people!

Don