Scam techie help needed (3 replies)

Mrs Harford's Mum died a few weeks back- Very difficult with Covid restrictions etc.
She took out a funeral plan to take things easier for the missis. Basically the Plan company, had an invoice from the director and paid out the thousands of pounds to a different person's bank account.
They say they paid into the account BACS on his invoice . He sent his usual invoice with another document by email They said his invoice wasn't with it and to send it again. Which he did.
they said this the third time it happened to them recently and that his email must have been hacked. They use AVAST and their IT guy says he checked and the email was definitely from the funeral director's email provider.
Is it possible to trace an email's source like this?
They also said they sent copies of his original email but he never receives them.
Something fishy the funeral plan co say they have paid the invoice and that is it as far as they are concerned. It was paid into a Santander accountant they say their bank can't give information.
I trust the Funeral director, small family business and I have done funerals with him for years. There is a few thousand left over to do the rest of the interment etc.So we will be welloutof pocket