The purchase was legitimate. Someone needed it, someone senior said yes, and the yes happened in an email because that is where the asking happened. Nothing is recorded against anything: the approval sits in one inbox, the delivery note is on a desk, the quantity that actually turned up was agreed verbally with the driver. Three weeks later a bill arrives and the first person in the company asked to make sense of it is the one furthest from the decision, accounts payable, holding a number, a vendor name and no way to tell whether the price is the price that was agreed or the quantity is the quantity that came.
The request becomes a purchase order before the money is committed, and the approval is a step on that order, with a second sign-off above a value you set rather than a reply in a thread.
What arrived is recorded against the order it arrived for, so the quantity received and the quantity invoiced are fields on the line rather than something a person remembers.
Nobody downstream has to reconstruct the purchase from memory to clear the bill. The order, the receipt and the bill are compared before payment, not after, and where they disagree beyond tolerance, nothing posts.