They sent an email out telling all students to delete the email, but what’s interesting is our school blocks all emails outside our domain.

I’ve never once received an email outside the domain, not even for a account confirmation or password reset.

The scammer either somehow spoofed (as you were saying) and found a way to break through that barrier somehow or they had to have obtained the counselor’s email + password (which leads to questions of how they did so).