Layer 2 frames for heartbeat: FortiGate HA heartbeat typically uses layer 2 frames to ensure quick and efficient communication between cluster members.
Virtual MAC address: FortiGate HA does not inherently share a virtual MAC address between members; instead, each device uses its own MAC for identification, while the primary unit might manage shared IPs.
Support for more than two members: FortiGate VM clusters can support more than two members in an HA setup, depending on the licensing and resource constraints.
Cluster member IPs: HA cluster member IPs are usually assigned statically for management purposes when configured within the same network.

The exhibited playbook requires intervention, which means that the playbook has reached a point where it needs a human operator to take action. The next step should be to go to the Incident Response tasks dashboard and run the pending actions. This will allow you to see the pending actions that need to be taken and to take those actions. The other options are not correct.

Emails with an empty sender address will be subjected to bounce verification:
BATV is specifically designed to address backscatter issues caused by misdirected bounce messages. It examines bounces (emails with empty sender addresses) to verify their authenticity.
FortiMail will insert the BATV tag to the sender address in the envelope:
FortiMail appends a unique tag to the sender address in the email envelope. This tag allows FortiMail to later verify if a bounce message was generated by the original recipient or is part of a backscatter attack.