OP, it is entirely possible the e-mail came from someone unaffiliated to the kitchen company - faking the sender e-mail address is not difficult and is commonly used to, for example, spread viruses under the guise they come from someone you know.
What it doesn't explain, however, is how the scammers knew that they should send you such an e-mail at that precise time - the scam could only work if they knew you were just asked to make a monetary transaction to some account, and only if they knew about both its participants. Clearly, the scammers had access to information they shouldn't have. So how did that happen? There are several possibilities:
- Your computer is compromised by a virus (some form of spyware, most likely) that allowed the scammers to read your emails (without needing to hack the email sever itself). If that is the case, you are out of luck and will almost certainly never see your money again. Still, definitely contact the police, even if your outlooks seem grim.
- Scammers gained your password and simply logged into your e-mail to get access to your correspondence. This can happen through a wide variety of means, from having a weak password to using the same one on multiple sites (one of which could be compromised. Database leaks with hundreds of thousands of passwords leak even to large companies from time to time). Again, in this situation, your outlooks would be very bleak indeed.
- The e-mail server itself got hacked. This is extremely unlikely, although possible. You might have a chance to sue for some compensation from the server owner. You'd need to consult your lawyer on that.
- The scammers had access to the kitchen company's e-mail (be it through them knowing the password, or having spyware, etc.). If that is the case, you should definitely sue. After all, the fault lies with them, not you. Their claim of "being hacked" would also hint at this possibility.
- Someone at the kitchen company is cooperating with the scammers and feeding them info directly.
Possibility 4 seems the most likely to me, but it could of course be the others (or some that I have forgot to list - possibilities are endless, as they say). In any case, you should immediately contact your lawyer and the police and have them find out just what exactly happened - don't get brushed off by the company saying "we got hacked". If they got hacked, then that's their own damn problem - they should have secured themselves better and should now bear the consequences.
As for why I advise you to sue - if the bank didn't manage to get your money back from the scammer account, it's almost certain that that money is gone forever. Sorry. But you can still get your money back from suing the person responsible for leaking the data needed to carry the attack out. In any case, contact the police and even more importantly, contact your lawyer.
