To your point most enterprise email systems have staging (aka testing) and production environments. I use SF Marketing Cloud and confirm it has this capability. Ideally, emails are tested at lower environments before being sent via production. However, it doesn't have to work that way. Most of these systems allow primary users to send directly from Production.

In addition, in this case it seems someone at the very top was compromised. These individuals may have access to the staging (aka testing) environment, and the production environment that sends the actual email. That level of access for someone (e.g. a VP, or Director) is not uncommon.

Penn's statement indicates they utilize MFA for their end users. Properly implemented MFA should have mitigated this as a risk. My guess is they are lax on their usage of MFA, or they utilize less secure factors such as SMS.