x2
If it appears to be coming from your cop friend (compare headers with one that's known valid - not everything need be identical, but the origin and receiving systems should be similar) then that person's computer is probably infected with malware and needs to clean (or wipe and reload) their computer. This happens to my parents roughly every six months - they can't seem to keep from clicking on things they shouldn't click on.
It it's coming from somewhere else, see if it jives with someone you or your friend both know, then have whoever it is clean their computer.
If it's somewhere else entirely, then your cop friend's email address is being spoofed and there's really not much you can do, assuming you still want to receive valid email from that person. The simplest in that case is for either you or your cop friend to get a new email address. Then you can stop using or block the old one.
BTW - being a cop does not make your friend any less prone to infection. There's even a chance it could cause your friend to be targeted, depending on the type of cop.