Flag verification emails and post a secure alert

Your verification and 2FA emails arrive without context, so you can't confirm legitimacy safely. The flow flags messages and delivers masked context for reviewer action within minutes.