I had an instance of a work e-mail years ago, that was sent from a third-party contractor, that had so many red flags for very obvious phishing (including coming from outside the organization, wtf).
Where I work, we have a place to forward phishing emails so that IT can review it. I forwarded it there, and apparently so many other people did that a follow-up email had to be sent out that said, "we thank everyone for pointing out this e-mail as phishing, but we can confirm it's actually legit."
I think they learned the lesson from that, because it has not happened since that we got such a terrible email. I think my point is that overtraining may not work, but having a place to report phishing is a great idea. It only takes one person to report it, and then the IT department sends out a massive e-mail to warn everyone else about it, so it doesn't rely on them recognizing it (and anyone that already fell victim to it can report that they have, so action can be taken to minimize the damage). And in cases like you and I experienced, they can also do the opposite and confirm that it's real.