Well, the user doesn't create any .eml, he just selects "forward as attachment" on the email, so the .eml file creation is transparent to him. For everything e

Well, the user doesn't create any .eml, he just selects "forward as attachment" on the email, so the .eml file creation is transparent to him. For everything else, you're right. Unfortunately, the practice of leaving the responsibility to the user is too risky, but it's ok for a PoC. In a production environment, as we were saying in the previous comments, there should be a way to intercept the email before it reaches the user's inbox, make the analyst analyze it timely and then make the email arrive to the user's inbox afterwards. I don't think that's possible with a human-in-the-loop approach, but only in a fully automated scenario, which will never work as intended.