The email said "just following up" but the subject line had a tracking hash in it. She'd seen that hash format before — internal ops usually didn't use one. She sat with the draft open for a few minutes, not clicking anything, scrolling back through their earlier thread. The grammar was very slightly off. Nothing she could point at in a way a manager would believe, but the kind of off that a real person wouldn't produce. She closed the email without replying. Then she opened a Slack DM to IT and asked if they could look at the sender headers before she did anything else.