And it’s always the people you think it’s going to be.
The thing is, in my org it's not; they get people from every team on the reg. One of the senior admins (OS admins, not office admins) on my team has gotten hit because our infosec team is mean and will send out emails from 'hr' when he is sending them too. They've almost gotten me a couple of times, and I'm basically the liaison to their team from mine.
My cito was laughing about it the other day because his name gets dragged through the dirt when it's his 2nd who does shit like send that stuff to new hires an hour after they start day one. Tends to keep people in their toes.