There would be a copy in the temp folder from a number of actions you could take interacting with the actual email. Including opening an attachment of viewing the appointment. Basically there are no user files in the system temp folder, they are simply files created by apps while they run for their convenience, not yours.

It is also possible that the file may have something to do with windows indexing, anti virus scaning or some other application on your computer. Thunderbird tends to use nsmail.eml for temp files. But those related to end to end encryption and calendar as newer changes may not. Seriously I would even doubt the source is Thunderbird.

Thanks! You have essentially confirmed my thinking, which helps a lot. I can't think of any correlation between the timestamp on that file and my use of the email message in the file, but I also had no reason to believe that the files comes from Thunderbird; there's just the .eml extension that Windows associates with TB.

I read that Process Explorer has a tool to allow tracing of what process wrote a particular file, but I downloaded Process Explorer and could not find such a tool. I don't even know in theory if NTFS contains a trace of the process that wrote the file (presumably in an alternative data stream).

Not that I am aware of. There are the normal security flags on TMP files, but I know of nothing special.

Found it: EMS(-n).eml files are created by extension Edit Mail Subject MX. In order to change message header, it writes a temporary file with the new Subject: line before replacing the old message. Thanks for your help in thinking it through.