Is a MIM (Man in the Middle Attack) by definition an altered or injected communication on an encrypted communication?

If so, what is it called when someone alters or interjects into un-encrypted communications? Is that email spoofing? How is it resolved?

End users probably are more concerned with the fast resolution of the current disruption to their work than with the technical prevention.

How would an account holder even know to speak with a security person since the recipient of a negative injected message is unlikely to respond or be open to printing copies for comparison with sent messages.

(Joe says "I love cats". The recipient receives the message "I hate cats", becomes angry and doesn't respond. Joe then says "Do you want me to babysit your kitten?". Recipient responds with "Piss Off". Joe says "You piss off!!!!!") The MIM is buried in the middle of several other authentic messages.

How would you know?