Can I verify a spoof email without having the email?

I checked our organization Defender for Cloud Apps portal this morning, just looking around at different activity logs and queries. I found something odd.
The activity shows usage on a mobile device, Apple iOS using MS Outlook, a creation of an email with attachments, both of which were in Kanji and Hanzi characters. This is not due to encoding as some were translated like "Please note that you should practice the customs of the process." as the email subject. Plus …

apple apple ios apps attachments cloud cloud apps cybersecurity defender defender for cloud device email ios logs mobile mobile device organization outlook portal spoof verify