At 12:00, a user received a reply saying, "Thanks for the email—are you sure it's correct?" The reply was to a message apparently sent from the user's account at 11:15, but the user denies sending it. Logs indicate the message was sent from the office, almost certainly from the user's PC. Entra shows no account sign-ins other than the user's, and the original message cannot be found in Sent Items, other folders, or Recoverable Items. There are also no log entries showing a hard delete, soft delete, or move. What could explain this behavior?
4 Answers
Check the message headers and run a full message trace first. The headers may show whether it was genuinely submitted by the mailbox, sent through a scheduled-send mechanism, or spoofed externally.
This can happen with delayed or scheduled mail. The message may retain its original sent timestamp while only being released later, which makes it look as though it was sent at 11:15 even though delivery happened afterward. Message trace should help confirm that.
A possible cause is a mismatch between the new and classic Outlook clients. Some actions, such as sending an attachment from Word, can launch classic Outlook through MAPI. The message may appear to send but remain stuck in classic Outlook’s Outbox until that client is opened again, at which point it finally goes out. Check which Outlook version handled the send and review the default app associations.
Also rule out address spoofing. Compare the authentication results and Received headers, then verify the originating client and submission details in the trace. If the message was truly submitted from the user’s workstation, a client-side queue or scheduled-send issue is more likely than an account compromise.
Sending a document from Word can trigger exactly this: classic Outlook creates the message, then closes while the message remains queued locally. It may not actually send until classic Outlook is launched again, sometimes during a later send action.