For the most part, detection will be the same as above, but you will have to take another step in retrieving the email that was sent to determine all users that could possibly be affected by the same strain of malware.