Let's see if the emails have DKIM validation again.
If there's a body hash (bh) parameter, then you can pull the DKIM key from DNS and prove one way or another whether it went through a mailserver with that DKIM private key.
From my understanding that is what happened in france in 2017