One of our phishing scenarios during a pentest went like this: we send an email saying something along the lines of "As per the manager (CCd) please download the latest software included". Then we attach the manager as CCd in the headers but never actually send the CC email using our server, making it look like the manager is aware and approves, while the real manager has never actually received the email. However what we're finding an issue with is how do we actually fix this problem? Does a solution exist which checks the CCd users and whether they've actually received the emails? Is there any other way to detect this?
There is no way to detect this and there is no tool for this. You would need to actually check with the claimed recipient or at least with the log files of the mail server - the latter is not something a normal employee could do.
I think you need to adjust the processes instead, i.e. employees should not trust anything written in the body, any attachments, the subject or the
Cc of the mails since these could all be arbitrary made up - similar to snail mail.
From is a bit more reliable if DMARC together with DKIM/SPF is used but with only a bit of social tricks
From can be made look trustable too even if DMARC is enabled.