How to restrict the fraudulent invoices from IDR process

We have three invoices in Oracle that appear to have come through IDR and have been identified as fraudulent/phishing/scams. We cannot locate the emails in the APInvoices inbox and need to better understand how these were loaded to Oracle and if we can block these email addresses.