When you have 30+ email filters set in cpanel, and you want to know exactly which one was triggered here is how to test:
Step 1. Find the email location.
Inside your Webmail look for the View Source or View Original option:
Or navigate to the files and find the email:
Step 2. Test the email from cPanel > Global Email Filters > Filter Test
Copy the message from step 1. and paste it into the box, then click on Test Filter.
and you will see exactly which filter was triggered:
Another way to test is from the terminal:
exim -d-all+filter -bf /etc/vfilters/domain.com </home/username/mail/path/to/mail
