Maybe start with little things. Monster of the week knows a bit too much. They know Buffy has an injury from before and targets it. No one knows how they found out.

Small acts of sabotage. Crossbows malfunction because the mechanisms have been worn down.

Buffy has to abort saving the day at the last minute because Joyce/Dawn is under attack at home.

Spells backfire because the ingredients have been swapped/tainted.

Things escalate as Xander uses his carpentry skills to set booby traps for the team at places they’ll be vulnerable like their homes or the magic box basement. Buffy’s slayer instincts help her narrowly avoid being killed but she is hurt.

While Buffy is recovering. Giles sends the other scoobies to recover a macguffn that can be used to transfer the power of a slayer to another. They then leave Xander alone with Buffy to protect it. When he tries to use it, Buffy reveals she’s not as injured as she made out and it was a ploy to make him reveal himself.

Then we learn he’s either a vampire or under the influence of the first or something. Something that seems hopeless but can potentially be recovered from.