Emails have a bunch of info in the headers, so there is more meta-data in the email it self.
Neither is perfect for finding the culprit but one scenario has zero meta-data and the other has some.