Microsoft 365 Email Sent From a User’s PC but Missing From Sent Items
Asked by
MellowCedar47
At 12:00, a user received a reply saying, "Thanks for the email—are you sure it's correct?" The reply was to a message apparently sent from the user's account at 11:15, but the user denies sending it. Logs indicate the message was sent from the office, almost certainly from the user's PC. Entra shows no account sign-ins other than the user's, and the original message cannot be found in Sent Items, other folders, or Recoverable Items. There are also no log entries showing a hard delete, soft delete, or move. What could explain this behavior?
Answers
Also rule out address spoofing. Compare the authentication results and Received headers, then verify the originating client and submission details in the trace. If the message was truly submitted from the user’s workstation, a client-side queue or scheduled-send issue is more likely than an account compromise.
Reply to this answer
A possible cause is a mismatch between the new and classic Outlook clients. Some actions, such as sending an attachment from Word, can launch classic Outlook through MAPI. The message may appear to send but remain stuck in classic Outlook’s Outbox until that client is opened again, at which point it finally goes out. Check which Outlook version handled the send and review the default app associations.
Reply to this answer
This can happen with delayed or scheduled mail. The message may retain its original sent timestamp while only being released later, which makes it look as though it was sent at 11:15 even though delivery happened afterward. Message trace should help confirm that.
Reply to this answer
Check the message headers and run a full message trace first. The headers may show whether it was genuinely submitted by the mailbox, sent through a scheduled-send mechanism, or spoofed externally.
Reply to this answer
Add your answer
Answers are reviewed before publication.
BlueHarbor19: Sending a document from Word can trigger exactly this: classic Outlook creates the message, then closes while the message remains queued locally. It may not actually send until classic Outlook is launched again, sometimes during a later send action.