The link your subscriber clicks isn't always the link you sent. In organisations using Microsoft Defender for Office 365, Safe Links rewrites links in inbound email into a safelinks.protection.outlook.com wrapper, so it can scan them and check them again at the moment of the click. Your original URL, UTMs included, sits inside that wrapper and is released when the reader clicks. Your tags still arrive. What changes is the link in the message, which now belongs to Microsoft, and the referrer your analytics sees.
That is a strong argument for tagging every email link: the query string rides through the rewrite intact, so it's the part of the link that still says where the click came from. To read what a wrapped link really points at, paste it into the URL decoder, which pulls the destination out of a Safe Links wrapper without opening it. Admins can also exclude URLs from rewriting, or use a mode that checks links through the Safe Links API without wrapping them in supported Outlook clients.
Keep email in the medium and use the source for the list. GA4's Email rule accepts email in either field, so you could put email in utm_source and something else in the medium. Don't. Keep utm_medium=email fixed and let utm_source name the list or automation: newsletter, welcome-flow, winback. Then one medium report shows all email, and one source report splits it by list.
One spelling, lowercase. GA4's Email rule accepts email, e-mail, e_mail and "e mail", and channel rules ignore case, so Email and email both reach the Email channel. Your reports do care about case: parameter values are case-sensitive, so a medium report shows Email and email as two rows. Pick email and never type it any other way.
Two links in one email need utm_content. Google's own example for utm_content is two call-to-action links in the same message. Tag the button utm_content=button and the text link utm_content=text-link, and the report shows which one readers use. If one send carries several destinations, the bulk UTM builder tags them all with one spelling. How to track email clicks covers the rest of the setup.