When an email comes into the listener, the default value for Source on an Incident comes in as 'Email' - where can this be changed? It is not in the initialization rules.
This is handled behind the scenes by the email listener. What you can do is add a Before Save rule as below (Number 9 - I used the 'Fax' value for Source for the sake of the example, you can replace it with the appropriate value for your business case). Please note that you may need to delete and readd the rule for IsNewRecord (Number 10) as it needs to be below the new rule on the list.