Avatar of cnetwiz
cnetwiz
Flag for United States of America asked on

Removed e-mail address/mailbox Other Staff receiving their e-mails

Hello,

Staff Members in our company are receiving e-mails to their mailbox that is received by our exchange server for a terminated/non-existing employee.  

in the example listed below, a current employee receives an e-mail that is addressed to an employee that no longer exists, "deletedstaffname@company.org".  Nothing shows up in Active Directory, Exchage or  Disconnected Mailbox,  Even searched ADSI Edit and cannot find any reference to the non-existing employee.

Question:  How would Exchange 2010 Ver 14.02 accept mail for a non-existing employee and then to send it to another staff member's mailbox.

Below is an example of a header one of our Staff member received.  
No where in the header does it reference the current staff member's e-mail address
only the non-existing address.

(the server name and ip address have been changed except for the received from:)


Received: from [5.63.45.185] ([5.63.45.185]) by exprod5mx206.postini.com
 ([64.18.4.10]) with SMTP;      Mon, 19 May 2014 20:26:10 GMT
Received: from [222.125.222.215] (port=66743 helo=[192.168.4.18]) by
 5.63.45.185 with asmtp id 1rqLaL-000PE-00 for  deletedstaffname@company.org;  Mon, 19
 May 2014 22:26:09 +0200
Message-ID: <537A6794.0070707@jpmchase.com>
Date: Mon, 19 May 2014 22:26:09 +0200
From: Ada Reyna <Ada.Reyna@jpmchase.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1
MIME-Version: 1.0
To: <deletedstaffname@company.org>
...
Return-Path: AmericanExpress@welcome.aexp.com
X-MS-Exchange-Organization-AuthSource: servername@company.org
X-MS-Exchange-Organization-AuthAs: Anonymous
Exchange

Avatar of undefined
Last Comment
cnetwiz

8/22/2022 - Mon
OriNetworks

There is a powershell command to purge disconnected mailboxes you may want to try since some servers may force retaining the mailbox for a preset number of days. I'm not sure if that has anything to do with it but you can also check all email addresses of the mailbox for the person receiving the mail.
akb

Open Exchange Management Console
Goto Recipient Configuration for someone who is receiving the email, Mailbox, Select User Properties, E-Mail Addresses tab.
Check if the terminated employee's email address has been added here.
If you find it then delete it.
Morgan Machin

I agree with akb.  That was the first thing I thought of.  You can have old email addresses added as aliases in the Addresses tab of the user's Exchange profile.  This allows the user to receive email through that old email address without having to use a license keeping the old user's inbox open in Exchange.
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
cnetwiz

ASKER
My Apologies for my late response, I have been on a leave of absence due to injury.
To answer your questions listed above:

This question was written to discover how to control the flow of SPAM my company receives.
The SPAM in question displays in the HEADER an unknown user recipient and these e-mails continue being received by Exchange 2010 and then sent to actual users and distribution lists.  

1.  Under disconnected Mailboxes there are no e-mail accounts listed.
However I did run the Purge command to make sure there were no hidden mailboxes.

$mailboxes = Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

$mailboxes | ForEach { Remove-Mailbox -Database $_.Database -StoreMailboxIdentity $_.MailboxGuid -confirm:$false }

2.  I ran the command to list all mail enabled SMTP address.  the user:   unknownuser@domain.org   Does not exist.
Get-Recipient -ResultSize unlimited | select Name -expand emailaddresses | Select SmtpAddress >  c:\temp\emails.txt

3.  The e-mail to the unknown user is received by multiple users and distribution lists.   Have checked the properties of these recipients and there is no other names listed in their exchange profile.  Verified thru ADSI Tool also.

4.  If Exchange 2010 is receiving an e-mail for an unknown user.    unknownuser@doman.org   is there a log on what Exchange is thinking when it determines what user to send this e-mail to ?    

Is there anything I am missing that I can try ?

Follow up Question:
In regards to #2.   If I can list all SMTP address, is there a way to also list what account the SMTP address is associated to ?
This would be to determine if an user e-mail account has multiple SMTP address attached to it.
ASKER CERTIFIED SOLUTION
OriNetworks

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
cnetwiz

ASKER
The Script helped with identifying email accounts with associated e-mail address, however, still trying to figure out the routing of mail thru exchange with a bogus "TO" e-mail address.    Will continue to investigate.  Thanks everyone