While monitoring the information security notification mailbox, a security analyst notices several emails were reported as spam. Which of the following should the analyst do FIRST?

Blocking the sender immediately without review could lead to blocking legitimate emails (false positive) or might not address sophisticated threats like spoofing.

Deleting the email from servers prematurely could remove critical evidence necessary for further investigation if the message turns out to be malicious.

Asking the sender to stop sending messages is ineffective if the sender is malicious or compromised, and it does not address the immediate threat assessment.

Reviewing the message in a secure environment, such as a sandbox or isolated virtual machine, is the critical first step to safely assess if the reported spam is benign, a phishing attempt, or contains malware, without risking compromise to the production network.