Maybe things have changed since I retired in 1997, but back in the day, traffic was classified by the originator and was clearly typed in - not surprisingly - the classification line. Recipients did not change classifications.
1997 rules have NOT changed. To me, what has been done is that classified information has been copied/retyped in some manner from a classified document or system into an e-mails on an unclassified system, with none of the classification markings copied/retyped into the new document.
Thus producing a document that, at a casual glance, would not have “confidential/secret/top secret/code word” in it and appear to be unclassified.