Random but what I always wonder is: what’s the point of forwarding?
Are we assuming they’re attaching the original email’s source so that the headers can be used to determine the source? Without that, the only thing useful I can think of would be any links in the email body.
Asking because I’ve owned an email address or two that got leaked in data dumps so I go crazy tracking down the sending server’s owner, any companies they’re pretending to be, any domain registrars, etc. and a lot of that requires analyzing the headers.
IT can look up the original (including all headers) based on the forwarded content. It’s on the same mail server.