Pretty much all phishing scams like this would have from addresses and server IP addresses from outside the company clearly visible if the employees were to look in the email headers.
If the IT security team used an internal account to send this and to collect the replies it implies that should this be real and not a test that the IT security people are themselves negligent to allow an account to be compromised externally.
If the IT security team used an external server to send this email and it got in (using an internal from address) it also implies negligence and the proper email system set up with SPF and DKIM checking should have sent this email to the spam bin or /dev/null at SMTP time.
Looking at the headers is one of the best ways to confirm or deny phishing scams (it's something that Microsoft seem to have gone out of their way to make hard for users) with defaults like hiding email addresses and just showing users names in outlook. Making it hard to view message source in the pissy little non-re-sizeable window that requires users to double click in the suspect email then select properties from the file menu. Then aside from email there's hide extensions of known file types (Microsoft what were you thinking with that one????).
I guess if you weren't sure then as it's an internal email you'd ask a line manager about it.
I think this is rather dodgy ground and it likely to have staff questioning every internal email they get for a long time.