I have a client who's missing some emails he sent last week. They disappeared from his Sent Items, and even searching didn't help. I found one of the missing emails in the Deleted Items folder. Now he's reporting that emails he moves from Sent Items to various folders are also disappearing and ending up in Deleted Items. We're trying to figure out why this is happening and how to stop it.
I checked his rules and noticed he had several that seem to delete emails with specific subject lines, but the emails he mentioned don't fall into those categories. He insists he didn't create those rules, so I disabled them all. I also looked for hidden rules using PowerShell but couldn't find anything unusual.
They use Proofpoint for spam filtering, but that typically only affects incoming emails, not outgoing ones. The only explanation I could think of is that he might be accidentally using the Ignore feature in Outlook, but I have no way of tracking what's been ignored other than checking each email manually. The mailbox audit shows emails being moved from Sent to Deleted but doesn't specify who or what caused that to happen.
I'm looking for ideas on what could be causing this issue or what I might have missed in my investigation.
5 Answers
To add to what’s been said, consider a message trace. It can show if messages are auto-deleted and whether any rules intervened at the time they were sent. If you believe the issue is on the user’s side, look into ending all their active sessions. If he doesn't have Multi-Factor Authentication (MFA) enabled, that should seriously be a priority, as his account might be compromised if he’s not moving these messages himself.
Combining what others have suggested, conducting a thorough mailbox audit is crucial. It can indicate which IP address and client performed actions on specific emails and help you pinpoint the cause.
This likely points to a client-side rule or some Outlook automation at play. Make sure to check out the rules under File > Manage Rules and Alerts for anything suspicious. Also, look for active add-ins that could be messing with mail handling, especially CRM sync tools. If nothing turns up, pulling the mailbox audit log might reveal who or what moved the messages, narrowing down the issue.
Since you mentioned checking for hidden rules with PowerShell, keep in mind that Outlook Web Access (OWA) can have additional rules that might not show up in the desktop version. I’ve seen situations where those hidden rules caused unexpected behavior.
Has your client been using an iPhone or iPad? There's a chance he might have marked certain senders as junk, which could lead to those emails getting deleted. It’s worth checking his iOS devices to see if that is happening.
I encountered a similar issue just last week, and it turned out to be the iOS Ignore function at play.
You’re right about those hidden rules! Good call on checking, but just be aware that if rules are hidden, they won’t show up in OWA either.