Exchange 2003 Server-Side Forwarding

[jamesb]

We've got an Exchange 2003 server, and a strange issue with one account.

This user's account was disabled back in 2006, and is forwarding it's e-mail to another user. The oddity is that this doesn't seem to be set through any standard exchange forwarding setting and I'm at a loss on how to get it to stop. It's definitely something server-side doing the forwarding, but I'm completely out of ideas for what it might be. Anyone?

[sukh]

1. Where have you already checked?
2. Check the user account in AD and look at the delivery restrictions on the exch tab
3. Login to the actual mailbox and check for rules.
4. Check messgae headers of a messaghe which has been forwarded.

[jamesb]

1. Already checked in the Exchange delivery rules, and everything in AD (also had a look through the actual LDAP properties in case something wasn't showing up in the GUI.
2. Done.
3. No can do - the account's disabled, the mailbox is disabled, all access to it is meant to be prevented and I can't reactivate anything without Director-level approval. Currently it's an irritation, but not that big a one.
4. The messages don't have anything odd in the headers, but this is added to the content - Auto forwarded by a
Rule - as far as I was aware any Outlook rules are client-side only, and since there's no client available I don't see how this could be happening.

Thanks for the suggestions.

[sukh]

1.There are server side rules in addition to client side rules. I suspect at this stage, this seems to be the most logical answer.
2. You've checked the obvious places except the rules, I know this may be an issue but I'd get director approval to check out the rules.
3, It's causing issues for you now and it's uses exch resources, should the email be forwarded on or not? Is this a risk ? Data breach? etc.. etc...
4. Could also create a mail look and bring you exch server down,.

I'd check.

[jamesb]

Thanks - I guess the options are either get the directors to approve the account access, or simply kill the mailbox (which still requires some obscure kind of approval - even though it was last used in 2006).

Alternatively in a couple of months we get to upgrade to Exchange 2010, so I could just quietly ignore the problem until then.

Either way, thanks again.