Ask who could act and what is recorded
A shared mailbox address identifies a communication endpoint, not necessarily a single author. Delegates, automated services and account configurations may affect how messages are sent and recorded. Establish the permissions and access arrangements relevant to the disputed period rather than relying only on the current configuration.
Potential sources
Preserve native messages, available audit and sign-in data, delegation records and relevant endpoint artefacts. Historical administrative records may help explain permission changes. Retain the context of any account disablement or investigation already undertaken. Access to these sources and their coverage depend on the service and configuration.
Attribution limits
A recorded account event, device association or IP address alone is not conclusive personal attribution. Missing logs may prevent a distinction between competing explanations. The assessment should correlate independent sources and state where it relies on assumptions. Begin with the message, relevant dates, known users and available authority. Possible outputs include an access chronology and a technical assessment of which propositions are supported, unresolved or contradicted by the material examined.