Link to home
Start Free TrialLog in
Avatar of cnetwiz
cnetwizFlag for United States of America

asked on

Removed e-mail address/mailbox Other Staff receiving their e-mails

Hello,

Staff Members in our company are receiving e-mails to their mailbox that is received by our exchange server for a terminated/non-existing employee.  

in the example listed below, a current employee receives an e-mail that is addressed to an employee that no longer exists, "deletedstaffname@company.org".  Nothing shows up in Active Directory, Exchage or  Disconnected Mailbox,  Even searched ADSI Edit and cannot find any reference to the non-existing employee.

Question:  How would Exchange 2010 Ver 14.02 accept mail for a non-existing employee and then to send it to another staff member's mailbox.

Below is an example of a header one of our Staff member received.  
No where in the header does it reference the current staff member's e-mail address
only the non-existing address.

(the server name and ip address have been changed except for the received from:)


Received: from [5.63.45.185] ([5.63.45.185]) by exprod5mx206.postini.com
 ([64.18.4.10]) with SMTP;      Mon, 19 May 2014 20:26:10 GMT
Received: from [222.125.222.215] (port=66743 helo=[192.168.4.18]) by
 5.63.45.185 with asmtp id 1rqLaL-000PE-00 for  deletedstaffname@company.org;  Mon, 19
 May 2014 22:26:09 +0200
Message-ID: <537A6794.0070707@jpmchase.com>
Date: Mon, 19 May 2014 22:26:09 +0200
From: Ada Reyna <Ada.Reyna@jpmchase.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1
MIME-Version: 1.0
To: <deletedstaffname@company.org>
...
Return-Path: AmericanExpress@welcome.aexp.com
X-MS-Exchange-Organization-AuthSource: servername@company.org
X-MS-Exchange-Organization-AuthAs: Anonymous
Avatar of OriNetworks
OriNetworks

There is a powershell command to purge disconnected mailboxes you may want to try since some servers may force retaining the mailbox for a preset number of days. I'm not sure if that has anything to do with it but you can also check all email addresses of the mailbox for the person receiving the mail.
Open Exchange Management Console
Goto Recipient Configuration for someone who is receiving the email, Mailbox, Select User Properties, E-Mail Addresses tab.
Check if the terminated employee's email address has been added here.
If you find it then delete it.
I agree with akb.  That was the first thing I thought of.  You can have old email addresses added as aliases in the Addresses tab of the user's Exchange profile.  This allows the user to receive email through that old email address without having to use a license keeping the old user's inbox open in Exchange.
Avatar of cnetwiz

ASKER

My Apologies for my late response, I have been on a leave of absence due to injury.
To answer your questions listed above:

This question was written to discover how to control the flow of SPAM my company receives.
The SPAM in question displays in the HEADER an unknown user recipient and these e-mails continue being received by Exchange 2010 and then sent to actual users and distribution lists.  

1.  Under disconnected Mailboxes there are no e-mail accounts listed.
However I did run the Purge command to make sure there were no hidden mailboxes.

$mailboxes = Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

$mailboxes | ForEach { Remove-Mailbox -Database $_.Database -StoreMailboxIdentity $_.MailboxGuid -confirm:$false }

2.  I ran the command to list all mail enabled SMTP address.  the user:   unknownuser@domain.org   Does not exist.
Get-Recipient -ResultSize unlimited | select Name -expand emailaddresses | Select SmtpAddress >  c:\temp\emails.txt

3.  The e-mail to the unknown user is received by multiple users and distribution lists.   Have checked the properties of these recipients and there is no other names listed in their exchange profile.  Verified thru ADSI Tool also.

4.  If Exchange 2010 is receiving an e-mail for an unknown user.    unknownuser@doman.org   is there a log on what Exchange is thinking when it determines what user to send this e-mail to ?    

Is there anything I am missing that I can try ?

Follow up Question:
In regards to #2.   If I can list all SMTP address, is there a way to also list what account the SMTP address is associated to ?
This would be to determine if an user e-mail account has multiple SMTP address attached to it.
ASKER CERTIFIED SOLUTION
Avatar of OriNetworks
OriNetworks

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of cnetwiz

ASKER

The Script helped with identifying email accounts with associated e-mail address, however, still trying to figure out the routing of mail thru exchange with a bogus "TO" e-mail address.    Will continue to investigate.  Thanks everyone