A SOC analyst is assigned a case involving a suspected credential-harvesting phishing email that multiple employees reported. The analyst has confirmed the email contains a link to an external login page. Before contacting affected users or blocking the domain, which investigative step provides the most reliable evidence to determine whether the sender address was forged and to identify the true origin of the message?