Reading Email Headers: The Trail a Message Can't Fake
Everything a sender types can be forged. Everything the relay servers stamped on the way through cannot be rewritten after the fact — which is why the headers are where the answer lives.
Wire Fraud: What to Do in the First 72 Hours
Almost everything that works on a fraudulent transfer works in the first day. Almost nothing works after the third. Here is the order to work in when it has already happened.