How are scammers sending scam emails from a real t-mobile email address

I got this email on 11/20/22 saying receive a reward for taking a short survey and I was skeptical too so I checked the email address and it looked like a legit email address so I took the risk and clicked the link. Even when it redirected to the survey it still looked like T-mobile and there was maybe 8 questions about T-mobile service but then after the survey you get redirected again to claim your free prize and just have to pay S&H and that site didn't look too legit but I decided to take the risk and claimed a prize and filled out the info fully expecting it to be a scam but I did actually get my prize with no issues. I took the survey two more times and claimed two more prizes for the price of S&H and I am currently tracking the delivery progress. What did happen though 5 days later (today) was I got a fraud alert from my bank asking if I authorized a purchase (I did not) and the merchant matched one of the sites I claimed a prize for so it seems the site was not secure and my credit card info got out, my bank did not authorize the purchase and is sending me a new card.