If your outbound email goes direct from your Exchange server, the easiest way to find this might be via your firewall logs. That will also give you some historic information as well in case the individual has stopped already.
Of course keep in mind this will only help if the individual is sending via your company's mail server. If they were smart, they wouldn't be doing that anyway.
Todd Nelson
Ronin provided some good references.
Keep in mind that the information being "leaked" may not be through email or even from your email domain. With that said, you should be able to easily create a mail flow rule in the EAC to send a copy of any email based on recipient addresses.
If you are currently configured for hybrid, make sure to create the rule both on premises and in EXO.
Lenny Cordisco
ASKER
Thanks Guys, ....and yes. I am aware that the leak may not be happening through our mail system. In fact, I advised the CEO that aside from adding rule on the mail server, there may be no way to figure this out. Most people use personal email and cell phones as well.
I would like to think that people are smart and would know not correspond with a competitor through our mail system...
Of course keep in mind this will only help if the individual is sending via your company's mail server. If they were smart, they wouldn't be doing that anyway.