Announcement

Collapse
No announcement yet.

Specific User receiving other user's emails

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Specific User receiving other user's emails

    Hi,

    One of my Exchange 2007 users has reported a strange problem, she is receiving copies of emails that are not intended for her, she isn't cc'd in on them at all and there are no forwarding rules on these other user's accounts to forward them to this user, nor does she have access to the other user's accounts.

    The tracking logs show that the email was delivered to both the intended user and the user in question.

    As far as I am aware this is only happening to one person, the emails are all external and she is receiving emails intended for a few random different people.

    Does anyone know what could be causing this?

    We are running Exchange 2007 Service Pack 1 on Windows server 03 x64, all our emails are scanned by Messagelabs for viruses and spam.

    Thanks in advance for any suggestions offered

    ChetP

  • #2
    Re: Specific User receiving other user's emails

    Have you got the headers from one of the messages in question?

    She isn't a PA or anything who has been setup as a delegate in Outlook?
    cheers
    Andy

    Please read this before you post:


    Quis custodiet ipsos custodes?

    Comment


    • #3
      Re: Specific User receiving other user's emails

      She is a delegate on a few accounts, but she isn't a delegate on the people she is receiving these emails from.

      Message headers from one of the emails in question is below.

      Received: from mail70.messagelabs.com (193.109.255.115) by EX2k7.edhcc.ac.uk
      (192.168.0.43) with Microsoft SMTP Server id 8.1.263.0; Tue, 8 Apr 2008
      06:06:32 +0100
      X-VirusChecked: Checked
      X-Env-Sender:[email protected]
      X-Msg-Ref: server-12.tower-70.messagelabs.com!1207631483!97023254!1
      X-StarScan-Version: 5.5.12.14.2; banners=-,-,-
      X-Originating-IP: [138.32.41.4]
      X-ContentInfo: mail is inbound, 14141 monitor inbound, edhcc.ac.uk
      X-Content-Flag: YES
      Received: (qmail 13414 invoked from network); 8 Apr 2008 05:11:24 -0000
      Received: from mailman1.ppco.com (HELO mailman1.ppco.com) (138.32.41.4) by
      server-12.tower-70.messagelabs.com with AES256-SHA encrypted SMTP; 8 Apr 2008
      05:11:24 -0000
      Received: from bvlextrd2.conoco.net (bvlextrd2.conoco.net [138.32.41.13]) by
      mailman1.ppco.com (Switch-3.2.7/Switch-3.2.7) with ESMTP id m385BMUm017519
      for <[email protected]>; Tue, 8 Apr 2008 00:11:22 -0500
      Received: from mail1.ppco.com ([138.32.31.56]) by bvlextrd2.conoco.net with
      InterScan Message Security Suite; Tue, 08 Apr 2008 00:11:21 -0500
      Received: from bvlexbh5.conoco.net (bvlexbh5.conoco.net [158.139.203.26]) by
      mail1.ppco.com (Switch-3.2.7/Switch-3.2.7) with ESMTP id m385BIk6017460 for
      <[email protected]>; Tue, 8 Apr 2008 00:11:19 -0500
      Received: from eurexbh3.conoco.net ([144.46.139.15]) by bvlexbh5.conoco.net
      with Microsoft SMTPSVC(6.0.3790.1830); Tue, 8 Apr 2008 00:11:17 -0500
      Received: from svgexmb5.conoco.net ([153.15.10.172]) by eurexbh3.conoco.net
      with Microsoft SMTPSVC(6.0.3790.1830); Tue, 8 Apr 2008 06:11:16 +0100
      Content-Class: urn:content-classes:message
      MIME-Version: 1.0
      Content-Type: multipart/alternative;
      boundary="----_=_NextPart_001_01C89936.F8894940"
      X-MimeOLE: Produced By Microsoft Exchange V6.5
      Subject: RE:
      Date: Tue, 8 Apr 2008 07:11:15 +0200
      Message-ID: <[email protected] onoco.net>
      In-Reply-To: <[email protected] edhcc.ac.uk>
      X-MS-Has-Attach:
      X-MS-TNEF-Correlator:
      Thread-Index: AciWaUyzlWgxZy19SIyGqlWpE030XwB4HCwgAA9fJeAAK+q0IA ==
      References: <[email protected] edhcc.ac.uk> <[email protected] onoco.net> <[email protected] edhcc.ac.uk>
      From: "Magee, Brendan" <[email protected]>
      To: "MAGEE, April" <[email protected]>
      X-OriginalArrivalTime: 08 Apr 2008 05:11:16.0291 (UTC) FILETIME=[F8E21930:01C89936]
      Return-Path: [email protected][/email]
      X-MS-Exchange-Organization-PRD: conocophillips.com
      X-MS-Exchange-Organization-SenderIdResult: None
      Received-SPF: None (EX2k7.edhcc.ac.uk: [email protected]] does
      not designate permitted sender hosts)
      X-MS-Exchange-Organization-SCL: 0
      X-MS-Exchange-Organization-PCL: 2
      X-MS-Exchange-Organization-Antispam-Report: DV:3.3.5705.600;SID:SenderIDStatus None;OrigIP:193.109.255.115
      Last edited by ChetP; 9th April 2008, 15:04. Reason: replace addresses with dummy addresses

      Comment


      • #4
        Re: Specific User receiving other user's emails

        Might be worth editing the headers in notepad and replacing the actual email addresses with dummy ones using the replace function. This will help with SPAM.

        EDIT: Just on the off chance, she isn't a delegate of the delegate (just in case there is an intermediary jump?)

        EDIT2: The headers look ok to me. Is Edit1 possible? April has a delegate and that delegate has a delegate of Linda?
        Last edited by AndyJG247; 9th April 2008, 15:02.
        cheers
        Andy

        Please read this before you post:


        Quis custodiet ipsos custodes?

        Comment


        • #5
          Re: Specific User receiving other user's emails

          I've just checked her outlook and her account on the server and she has no delegates at all.

          Comment


          • #6
            Re: Specific User receiving other user's emails

            Most odd!
            Do the tracking logs show the message came in to both externally or only internally? Is it possible to post (minus identifiable info) the tracking log too. To be fair in most cases it is delegates or BCC fields.
            I assume there are no transport rules setup in Exchange?
            cheers
            Andy

            Please read this before you post:


            Quis custodiet ipsos custodes?

            Comment


            • #7
              Re: Specific User receiving other user's emails

              Problem solved! apparently these emails were triggering a content control rule at Messagelabs and the action in this event was to copy the emails to an administrator.

              However I have no idea how this has occurred as it's not something we've set up, but I guess thats something I'll have to work out.

              Many thanks for your help AndyJG247!

              Comment


              • #8
                Re: Specific User receiving other user's emails

                Glad it is sorted.
                The logs should have shown it coming into both users from the outside, bit of a strange one none the less
                cheers
                Andy

                Please read this before you post:


                Quis custodiet ipsos custodes?

                Comment

                Working...
                X