Top User of Mail

Posted on 2013-10-01
Medium Priority
Last Modified: 2013-10-01

We have a user that keeps showing up consistently as the top user of mail according to a daily report that is run from a reporting software that gets data fed to it from our corporate firewall.

The user only connects to his mailbox using OWA (Outlook Web Access) on a exchange 2010 server. The PC that he logs into has a generic login so that is why he connects to exchange using OWA. We have scanned on the PC to ensure that there aren't any viruses, the PC has come back clean. Other users connect to their mailbox via OWA on this PC as well and are not showing up as a top user of mail the same as this user does.

Does anyone have any ideas as to how he could be showing up as the top user of mail day after day?

Any help on this would be greatly appreciated.

Thank-you in advance for taking the time to respond back.

Question by:ellitech
  • 3
  • 2
LVL 22

Accepted Solution

Nick Rhode earned 2000 total points
ID: 39536525
I would try reseting the users password.  Could have had his U/N and Pass hijacked and now email is relaying from your server from an external source.  I would also check his PC and do a thorough scan.  You can follow this guide for assistance.


Now when you have him as the Top user.  Is the email significant like he is sending out 2000 more messages than everyone else etc?

Author Comment

ID: 39536573
I looked at the report and he have 1643 events whereas the next highest user has 21.

Pretty significant difference.


Author Comment

ID: 39536580
324.702 MBytes versus 28.907 MBytes of data sent via OWA. I am going to reset the users password and see if that makes a difference.

Thanks for your help...


Author Closing Comment

ID: 39536624
Thanks, I have reset his password, the PC was already scanned and we'll see tomorrow morning when the next report comes out.


LVL 22

Expert Comment

by:Nick Rhode
ID: 39536666
Just keep an eye on it for some viruses cannot be picked up by windows scanners.  Possibly a little keylogger of somesort but you never know :)

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Understanding the various editions available is vital when you decide to purchase Windows Server 2012. You need to have a basic understanding of the features and limitations in each edition in order to make a well-informed decision that best suits …
In this article, we will discuss how you can secure Active Directory using free tools, and how you can choose a safe and secure Active Directory security auditing tool.
This Experts Exchange video Micro Tutorial shows how to tell Microsoft Office that a word is NOT spelled correctly. Microsoft Office has a built-in, main dictionary that is shared by Office apps, including Excel, Outlook, PowerPoint, and Word. When …
Through the video, you can check the migration process of Outlook PST file to PDF. Kernel for Outlook to PDF tool can convert Outlook emails with all attributes like Subject, To, From, Cc, Bcc and other folders such as Inbox, Outbox, Sent Items, Jun…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question