Avatar of Apexadmin
 asked on

Exchange 2007 same email over and over

I have a user that is getting this one email over and over every 5-10 minutes. It is Exchange 2007 on a 2008 SBS server. No other user is having this issue. We have a spam filter device in the cloud that filters the mail, the mail is duplicating through it. I look at the Exchange Message tracking. It shows the email over and over to the user and the messageID is the same. Thoughts?

Avatar of undefined
Last Comment

8/22/2022 - Mon
Cris Hanna

I'm guessing that you are using the POP3 connector and someone was BCC'd in this email?

When you track the message, what are the events that you see?
Do you see a Receive SMTP over and over again? if yes, what is the client IP? what is it pointing to?

Have you disabled Store duplicate detection? Check the keys mentioned in

Is this happening to only one user? what is the message type that he is getting? IPM.NOTE?

The EventID is RECEIVE, Source is SMTP. It is over and over again. The Client IP is the cloud spam filter, where it was sent from, days prior.

I have not disabled Store duplicate detection.

Yes, only one user. I am not sure of the message type.

Weird thing is, I think it has stopped. The logs don't show anymore. Waiting for the user to get in to confirm.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes

If you are seeing multiple SMTP receive events that means that the mails are coming in from the cloud spam filter over and over again. Recommended to check with the Cloud spam filter team on why they are submitting it so many times

We manage and monitor the spam filter device. There are no logs of this email sending multiple emails and it logs everything. Also wouldn't each email have a different Mail ID on the Exchange server if it was being sent from an outside source over and over?

That is correct. The reason why I was talking about Multiple emails coming in was because when the Message tracking shows that multiple SMTP receives, then it usually means that the message is received on the server multiple times.

Ideally message Id should have been different for different emails received by the Exchange from internet provided the Message Id is not stamped on the message previously before reaching the Exchange server. what is the message ID field in the message tracking show? does it show the same message ID every time?
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.

It is the same message ID every time.

If the message is being stamped by the sending server, the Exchange will not take the pains to stamp the message ID again.

What is the Message ID? does it have your server name in it? if the Exchange is stamping with a message ID, then the message ID will have something like this


Message-ID: <B6E704C90D73D449BFB7F58C5C1F615405116D@Server FQDN here>

See the server FQDN part. Is it your server's FQDN?
Above is just a sample message ID.
The part before @ can be any random string but after that will be your server's FQDN if it is stamped by the Exchange server.

This is the message ID for all of them. The same exact.


I have no idea what that domain but that is not customers domain nor is it the senders.
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

The issue stopped before I could further isolate it. All your troubleshooting steps were very helpful. Thanks.