One clue was that it came from a gmail address.

This is always the first place to look. Almost all of these emails have spoofed or hacked "from" lines, which never (as far as I can tell, but who knows?) match the corporate source.