I am the VOIP Administrator for the company that owns that DID phone number.  It is being spoofed.   I have checked the phone usage of that extension and the employee is not making any suspicious outbound calls (hardly any at all).