so you are thinking that an email being sent out via a user event or workflow during creation is where it is coming from?