We help IT Professionals succeed at work.

Removed e-mail address/mailbox Other Staff receiving their e-mails

cnetwiz
cnetwiz asked
on
162 Views
Last Modified: 2014-09-04
Hello,

Staff Members in our company are receiving e-mails to their mailbox that is received by our exchange server for a terminated/non-existing employee.  

in the example listed below, a current employee receives an e-mail that is addressed to an employee that no longer exists, "deletedstaffname@company.org".  Nothing shows up in Active Directory, Exchage or  Disconnected Mailbox,  Even searched ADSI Edit and cannot find any reference to the non-existing employee.

Question:  How would Exchange 2010 Ver 14.02 accept mail for a non-existing employee and then to send it to another staff member's mailbox.

Below is an example of a header one of our Staff member received.  
No where in the header does it reference the current staff member's e-mail address
only the non-existing address.

(the server name and ip address have been changed except for the received from:)


Received: from [5.63.45.185] ([5.63.45.185]) by exprod5mx206.postini.com
 ([64.18.4.10]) with SMTP;      Mon, 19 May 2014 20:26:10 GMT
Received: from [222.125.222.215] (port=66743 helo=[192.168.4.18]) by
 5.63.45.185 with asmtp id 1rqLaL-000PE-00 for  deletedstaffname@company.org;  Mon, 19
 May 2014 22:26:09 +0200
Message-ID: <537A6794.0070707@jpmchase.com>
Date: Mon, 19 May 2014 22:26:09 +0200
From: Ada Reyna <Ada.Reyna@jpmchase.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1
MIME-Version: 1.0
To: <deletedstaffname@company.org>
...
Return-Path: AmericanExpress@welcome.aexp.com
X-MS-Exchange-Organization-AuthSource: servername@company.org
X-MS-Exchange-Organization-AuthAs: Anonymous
Comment
Watch Question

CERTIFIED EXPERT

Commented:
There is a powershell command to purge disconnected mailboxes you may want to try since some servers may force retaining the mailbox for a preset number of days. I'm not sure if that has anything to do with it but you can also check all email addresses of the mailbox for the person receiving the mail.
akb
CERTIFIED EXPERT

Commented:
Open Exchange Management Console
Goto Recipient Configuration for someone who is receiving the email, Mailbox, Select User Properties, E-Mail Addresses tab.
Check if the terminated employee's email address has been added here.
If you find it then delete it.
I agree with akb.  That was the first thing I thought of.  You can have old email addresses added as aliases in the Addresses tab of the user's Exchange profile.  This allows the user to receive email through that old email address without having to use a license keeping the old user's inbox open in Exchange.

Author

Commented:
My Apologies for my late response, I have been on a leave of absence due to injury.
To answer your questions listed above:

This question was written to discover how to control the flow of SPAM my company receives.
The SPAM in question displays in the HEADER an unknown user recipient and these e-mails continue being received by Exchange 2010 and then sent to actual users and distribution lists.  

1.  Under disconnected Mailboxes there are no e-mail accounts listed.
However I did run the Purge command to make sure there were no hidden mailboxes.

$mailboxes = Get-ExchangeServer | Where-Object {$_.IsMailboxServer –eq $true} | ForEach-Object { Get-MailboxStatistics –Server $_.Name | Where-Object {$_.DisconnectDate –notlike ‘’}} | select displayname, mailboxguid, database

$mailboxes | ForEach { Remove-Mailbox -Database $_.Database -StoreMailboxIdentity $_.MailboxGuid -confirm:$false }

2.  I ran the command to list all mail enabled SMTP address.  the user:   unknownuser@domain.org   Does not exist.
Get-Recipient -ResultSize unlimited | select Name -expand emailaddresses | Select SmtpAddress >  c:\temp\emails.txt

3.  The e-mail to the unknown user is received by multiple users and distribution lists.   Have checked the properties of these recipients and there is no other names listed in their exchange profile.  Verified thru ADSI Tool also.

4.  If Exchange 2010 is receiving an e-mail for an unknown user.    unknownuser@doman.org   is there a log on what Exchange is thinking when it determines what user to send this e-mail to ?    

Is there anything I am missing that I can try ?

Follow up Question:
In regards to #2.   If I can list all SMTP address, is there a way to also list what account the SMTP address is associated to ?
This would be to determine if an user e-mail account has multiple SMTP address attached to it.
CERTIFIED EXPERT
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
The Script helped with identifying email accounts with associated e-mail address, however, still trying to figure out the routing of mail thru exchange with a bogus "TO" e-mail address.    Will continue to investigate.  Thanks everyone

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.