Possible site hack

I have been getting weird emails that make it seem like our site has been hacked. See attached for images of the last two. Any assistance would be appreciated. Thank you.
 

Without your club number we can do nothing for you.

Club # is 4413485. Thanks

1) Those are spam emails impersonating your domain. The from IP is not the IP of the FTH server.

2) Emails from the FTH server come from agenda@toastmastersclubs.org or server@toastmastersclubs.org

3) The admin e-mail address is the e-mail of the current registered club website administrator for this club. Anyone can send messages to this address.

I am a bit confused. Both of these emails came from server@toastmastersclubs.org
In the past, I have flagged certain email addresses as spam when I don't recognize the sender. But both of these appeared to be from a legitimate source.
Is there some action you would suggest I take? Thanks again.

You can see where the email originated in the header

5.181.3.107 is not the IP of FTH

I have blocked that IP for now.