You may find this article on Spoof e-mails of interest. It gives information as to how the details of a header may be impersonated.
Depending on the company concerned, it may take considerable time for a response to be received, but two months is considerable. Any company that "had their back turned when it was sent" may have either poor control or no oversight but only a full investigation may determine this.
There are contacts to whom spoof e-mails may be reported depending on the country of residence, the origin of the e-mail and its intention. To seek a contact local to you I suggest a search using the term 'spoof e-mail' as an initial input.