I'm investigating a strange Microsoft 365 mail incident. At 12:00, the user received a reply saying, "Thanks for the email—are you sure it's correct?" The reply was to a message supposedly sent from the user's workstation at 11:15, but the user denies sending it.nnOur logs show that the message was sent from the office at 11:15, and it appears to have originated from the user's PC. Entra ID shows no other sign-ins to the account besides the user's normal activity. However, the original message cannot be found in Sent Items or any other mailbox folder, including Recoverable Items. The logs also don't show a hard delete, soft delete, or folder move.nnWhat could explain an email being logged as sent while disappearing from the mailbox?
4 Answers
Another possibility is a mismatch between the new and classic Outlook clients. Some Windows 11 setups have different file types or mail actions assigned to different Outlook versions. An email created through Word or another application can launch classic Outlook through MAPI, place the message in its Outbox, and then close without actually submitting it. The message may not send until classic Outlook is opened again, sometimes much later.
Check the message headers and message trace first, especially for signs of a delayed or scheduled send. A message may have been created earlier but only submitted to Exchange later, which can make the timestamps look confusing.
I’d also verify the message’s complete headers and run a full message trace. That should help distinguish a delayed submission from address spoofing or a message that was routed through an unexpected client or connector. Checking the sending status and authentication results in the headers is useful too.
This can happen when an email is scheduled to send later. In one similar case, Exchange recorded the message as sent using the original send time, while the client didn’t show it normally because it had been queued for delayed delivery.
This is especially likely when using Word’s “Share as attachment” option. Word can open classic Outlook in the background, create the message, and leave it in the Outbox after Outlook exits. The next time classic Outlook starts, the queued message is finally sent.