Random but what I always wonder is: what’s the point of forwarding?
Are we assuming they’re attaching the original email’s source so that the headers can be used to determine the source? Without that, the only thing useful I can think of would be any links in the email body.
Asking because I’ve owned an email address or two that got leaked in data dumps so I go crazy tracking down the sending server’s owner, any companies they’re pretending to be, any domain registrars, etc. and a lot of that requires analyzing the headers.