Steps to reproduce

Check the sys_email record
Check the any affected incident number INCXXXXXXX

You will find it was not updated properly, the sys_email record will show the next message:

Unable to locate incident ___SYS_ID_NUMBER___ for inbound email processing

Reason for the ISSUE

The incident belongs to a different domain than the user who sent the email

Troubleshooting

1) Go to the sys email record:

https://[[Instance-NAME]]/sys_email.do?xxxxxxxx

2) Identify the user field for that record

3) Identify the target record from the email (incident number)

4) Right click on 'Show XML'. You will see the next information:

If you go here, right-click the header, and select 'Show XML' you can see information similar to this:

<sys_domain>XXXXXXXXXXX</sys_domain>
<sys_domain_path>!!!/!!!/!!&/</sys_domain_path>

5) Compare both the user domain and the incident domain and they will be different

Solution

If you consider the user AAAA in the wrong domain or want to know why it is different than expected and when it has changed - you can enable auditing on the sys_user table through the Dictionary entry here

https://[[[INSTANCE_NAME]]]/sys_dictionary_list.do?xxxxx

Consider either changing the domain of the user, the domain of the incident.

Note: This issue could occur after upgrading an instance or modifying the user records

Warning: Ensure these actions are tested in sub-production instances before implemented in production environments