I changed the setup so that each email was processed in a fresh context. For this, I deleted recent memory and processed each email one at a time. Edited the post to make it more clear.

You think it would behave worse if it thought the threat is real rather than it's an excercise?