iPhone user is receiving text-to-email from another person using their phone number. How to trace?

The user received a legitimate email with a return address using their text mail address. However they didn't send the email, they only received it.  The sending address is their phone number @ mms.att.net
The user has an iPhone, an iPad and an iMac.  The email was received on the iPhone and iPad, but not on the iMac.  

Is there a way to see the header on an email received on an iPhone or iPad?

They have since called AT&T and made sure that they don't share their phone number account with anybody else.
ATT told them that they also share a satellite TV account with another person, but that this other person is the only control for the shared account.

The user changed their iCloud password, and confirmed that they have 2-factor authentication turned on.

My guess is that their phone number is embedded in the Mac Messages app on some computer somewhere, and that when a file was 'shared' the Messages app sent the file using a wrong phone number.

Naturally, they don't want people sending out email using their AT&T phone number

Any idea how this return address appeared?

Thanks.