How do you work out why you're receiving an email?

[kennysarmy]

We have a shared mailbox for IT admin related stuff.

 

Recently we've been getting emails from a member of the teaching staff - but we're not in the TO: or CC: or BCC: options.

 

A message trace shows the email coming from the user to us - but we can't work out why it would be generating this email.

 

We've checked any strange message filters she might have but nothing.

 

Any ideas where to look?

[jmak]

Have any of the other email addresses got auto forwarding set up?

 

Has it been sent to a group you're a member of?

 

Or a Teams channel?

[LeMarchand]

Some long-forgotten auto-forwarding rule in Exchange (if you use it)?

[kennysarmy]

Have any of the other email addresses got auto forwarding set up?

 

Has it been sent to a group you're a member of?

 

Or a Teams channel?

 

Thanks for the ideas.

 

Seems to happen when they send to an external account - so don't think any of your options could be it...

[kennysarmy]

Thanks for the ideas.

 

Seems to happen when they send to an external account - so don't think any of your options could be it...

 

Just tested with the account and sent one email to my personal address and this did not trigger a copy being sent to our shared mail address - curious...

[kennysarmy]

Will raise a call with Microsoft - perhaps they can advise how we'd troubleshoot this.

[TechMonkey]

Their email didn't have any sensitive or personal information, did it? I seem to recall we'd get this occasionally and it was to do with some data loss protection. I thought they had made it so a covering email now was sent to the admins, but that may be a change in license.

[steveg]

Definitely no mail flow rules defined in exchange admin center? We have some for checking for inappropriate language and copying the email to a monitored box, they do look like they have just come directly from the sender.

[robintech]

Maybe an alias ?, exchange message trace should show the steps it went through before it got to the mailbox

[kennysarmy]

So by way of update.

 

If I send an email with the subject: "Fw: Piano"

 

And two specific lines of text:

 

, Alfie was late

 

Then I get a copy of the email.

 

 

I've narrowed the policy down to this one, "Anti-spam outbound policy (Default)"

 

However the current settings are:

 

Protection settings

 

Restrict sending to external recipients (per hour)

0

 

Restrict sending to internal recipients (per hour)

0

 

Maximum recipient limit per day

0

 

Over limit action

Restrict the user from sending mail until the following day

 

Automatic forwarding

Off - Forwarding is disabled

 

Send a copy of outbound messages that exceed these limits to these users and groups

On

 

Notify these users and groups if a sender is blocked due to sending outbound spam

On

 

 

Still totally confused...

[bald_pig]

Send a copy of outbound messages that exceed these limits to these users and groups

On

 

Sounds like you've put the IT Admin address for this, can't tell you why it's hitting the rule though.

[kennysarmy]

Sounds like you've put the IT Admin address for this, can't tell you why it's hitting the rule though.

 

No, it's very very odd!

[kennysarmy]

Microsoft engineer just spoken to me and admitted the policy is "wonky"!