Where the parcel notice really came from
Read a Received chain from the bottom up. Find the first hop, the desktop name and IP it was sent from, and the clue in Message-ID that a courier’s mail platform did not send it.
Briefing
Each mail server adds a Received header on top as it passes a message along, so the oldest hop is at the bottom. The bottom one usually shows the sending client.
A large courier sends notices from its own mail platform. Here the bottom hop is an authenticated submission (ESMTPSA) from a Windows desktop name.
mail-triage · Email and phishing
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.