The “sender email” in the exported suspended tickets CSV as well as the “from” address in the suspended tickets API response seem to be the value of the actual “reply-to” header. Unfortunately when a ticket is suspended due to it being “Detected email as being from a system user”, this logic is based on the actual “from” email, which is not included in the suspended ticket data, so it makes it difficult to see exactly why the ticket was suspended.
If the actual “from” email could be included in the suspended ticket data as well as the “reply-to” that would be very helpful.
Thanks.
