The root problem here is that someone moved money/resources on the basis of an anonymous (i.e. unsigned) email. If you can't be sure where the email came from y

The root problem here is that someone moved money/resources on the basis of an anonymous (i.e. unsigned) email. If you can't be sure where the email came from you really need to do a manual verification.