Reliably denying the use of Tor is not possible.
You could use bridges, but if someone sees traffic from your host to some destination and he thinks it is a bridge he just can connect to it and use it as bridge and therefore know that you use Tor.
Obfuscated bridges (obfsproxy bridges or flash proxy) might work better, but there are still ways to discover the use of Tor. Though one can't see that one is using Tor from just looking at the traffic.
Using a VPN before connecting to Tor could make you identifiable from the VPN providers side. Indeed another step for someone to investigate. Given "your" use-case it wouldn't have helped much if he would have been the only one that connected to a VPN provider at the time the email was sent.
I think the solution to "He is using Tor, so he is a suspect." is to have more users use Tor. The more users there are the more people one could hide in.
No one should do stupid things over Tor anyway.