If a user reports a phishing email we will want to examine the email properties to verify it's source. Many phishing emails may actually be sourced from KnowBe4 which is our end user phish testing / training system. The user can forward us the email with the properties in tact by using "Forward as Attachment".