custom attributes for email incidents

Hello Team,

It's my first post so let me say hello!

Could you please advise on the scenario below:

1. User sends an email on behalf of shared mailbox.

2. Network prevent for email detects violation and blocks the message from sending outside.

How  to find who is the real vilolator? - I was thinking of additional headers but it seems X-Headers are not taken from the message so this cannot be used.

I would appreciate your comments.