When any user is forwarding the email to ServiceNow production email address on an email which he/she receives on any incident, it is creating the new incident record with the forward email information.

Any forward emails wanting to be coming into the instance are treated as a NEW, it is a out of the box Behaviour.

To overcome the above behavior move the glide.email.forward_subject_prefix(make this empty) over to the glide.email.reply_subject_prefix section, and therefore they'll be treated as replies.

Ensure the forward prefix table has no forward prefix's in glide.email.forward_from_prefix. Keep this blank.

A forward will now always be treated as a reply.

But this will have an effect on all the forward emails.