Can an email identify the person who wrote it?¶
title: Can an email identify the person who wrote it? subtitle: An email may link strongly to an account or device and still fall short of proving who composed the words. slug: can-an-email-identify-the-person-who-wrote-it series: email-evidence section: sender-and-account-attribution card_type: question_card pathway_order: 9 section_order: 3 status: draft public_safe: true video_ready: true word_count: 560 estimated_read_time_seconds: 232 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - authorship - person attribution - account attribution - corroboration sources: - title: 'RFC 5322: Internet Message Format' url: https://www.rfc-editor.org/info/rfc5322/ - title: 'RFC 6376: DomainKeys Identified Mail (DKIM) Signatures' url: https://www.rfc-editor.org/info/rfc6376/ - title: 'RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)' url: https://www.rfc-editor.org/info/rfc9989/ - title: 'Microsoft Learn: Use MailItemsAccessed to investigate compromised accounts' url: https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts
Can an email identify the person who wrote it?¶
An email may link strongly to an account or device and still fall short of proving who composed the words.
Script¶
An email may provide a strong link to a mailbox, service or device.
That still doesn’t automatically identify the person who wrote it.
There are several steps in the chain.
The message may display a particular From address.
The delivery records may show that it came through the provider serving that domain.
Provider records may link it to an authenticated account or session.
Device evidence may show that the account was open on a particular phone or computer.
Those facts can be important.
But authorship asks a narrower human question:
Who actually composed or approved these words?
A single account may be used by several people.
A shared mailbox may be accessed by a team.
An assistant may send on behalf of a manager.
A family may share a device.
A customer-management system may generate a message from stored data.
An application may send an automatic notification.
An account may be compromised.
A person may dictate the message while somebody else types it.
The email header isn’t designed to record the human at the keyboard.
That doesn’t mean authorship can never be established. It means the conclusion usually comes from combining sources.
Start with the account evidence.
Was the message present in Sent Items or Drafts?
Did the provider record an authenticated sending event?
Which account, session, application or API credential was used?
Were there unusual sign-ins, forwarding rules or connected applications?
Then consider the device evidence.
Was a draft or local copy found?
Was the email client open at the relevant time?
Were there browser sessions, notifications, attachments or local files connected to the message?
Did the device record account access from the same period?
Now look at the wider context.
Does the content contain knowledge available only to a small group?
Does it continue an existing conversation?
Does it refer to real events, documents or arrangements?
Does the timing fit the person’s access and opportunity?
Are there witnesses, admissions, replies, payment activity or other communications supporting the link?
Writing style may contribute, but be cautious. People change style, copy text, use templates, receive help and increasingly use automated writing tools. Style alone is rarely a safe route to identity.
Also distinguish between creation and sending.
One person may write a draft, another may press Send, and a system may transmit it later.
A provider log identifying the sending account may not identify the author. A document or draft on a device may support authorship without proving who sent the final version.
The common mistake is to make one large jump:
“This email came from the account, therefore the account holder wrote it.”
That ignores shared access, delegation, automation and compromise.
The opposite mistake is to say that email can never help identify a person.
A well-preserved message, strong provider records, exclusive account control, matching device evidence and corroborating context may create a compelling attribution.
Just explain the steps.
A careful conclusion might be:
“The message was sent through this account during a session linked to this device. The content and surrounding communications are consistent with the account holder’s involvement.”
That is more transparent than pretending the From field identified the author by itself.
Think of authorship as a chain of links.
Message to account.
Account to session.
Session to device.
Device and context to person.
The stronger and more independent those links are, the safer the conclusion becomes.
Key takeaway
Proving that an account sent a message is not the same as proving which person authored it.
Related questions¶
- Does the From address identify the sender?
- What if the sender’s account was compromised?
- What if the email address was spoofed?
- Should I preserve the mailbox as well as the individual message?
Source notes¶
- RFC 5322: Internet Message Format
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
- Microsoft Learn: Use MailItemsAccessed to investigate compromised accounts