I don't know if this is an option for you, but we use resolved to indicate that we believe an issue is resolved. If the end user replies to the resolution notification then a quick action will run that sets the status back to active.
In addition when the status is changed to resolved the escalation engine is used to run a quick action 3 weeks later which sets the incident to a status of closed after which it's read only to anyone. A reply after this point will just log a new incident which can then be linked.
If you want any further details just let me know.
If you don't mind me asking, how do you have this setup. My best guess is a rule with 'on link' when status is 'closed' that creates a new incident. Does this sound about right?
It's easier than that. When an incident is in it's final state it can't be updated, so we have our email listener set up to log an incident on failure.
If anyone replies to a closed incident the listener can't update the original incident so it fails and logs a new incident. Simple.
The service desk agent will then look at the old incident to see if they are in fact related and if they are they'll manually link them. More often than not people reply to old incident notifications to report new problems as it easier for them than remembering our [email protected] email address (tricky to remember I know )
Hope that helps.