Spoofing forges or imitates identity. Account takeover abuses a real account. Phishing manipulates recipients into taking an action. Malware uses messages as a delivery mechanism. Business email compromise often combines social engineering with compromised or lookalike identities.
No single control stops all of these. Domain authentication, identity security, filtering, user reporting and incident response cover different failure modes.