send your ideas, in my experience there are a series of steps (not necessarily in order) to perform, for example, I look at:
- ip reputation
- server
- email format
- email content
- email attachments
- relationship between the email and the content
- etc
mainly in those, when it is more detailed it is according to the context of the email, to whom it arrived, at what time it arrived, had it already arrived before, etc.