Preserve the original attachment through approved incident tooling.
Calculate or obtain a cryptographic hash without opening the file on a normal workstation.
Search mail/security telemetry for that hash where supported, then pivot to filenames, message identifiers, sender infrastructure and recipients.
Determine which copies were blocked, quarantined or delivered and coordinate endpoint investigation for recipients who may have opened the file.
Filename equality alone is weak evidence; hashes and message context are stronger pivots.