We have a user's mailbox (Office 365/hosted Exchange) that was copying all messages to an external (unsolicited) recipient but not leaving a trace in the mailbox. I have removed two addresses in mail forwarding and inbox rules, but I am unable to find where the outbound messages are being sent and removed from the sent folder.
- Forced password reset on account
- ran malware/antivirus - (no hits)
- checked rules in Outlook and OWA - (found rule in OWA that was forwarding mail to a different malicious address)
- checked Outlook for RSS feeds - (none listed)
- checked server-side transport rules for tenant- (nothing applicable)
- checked mail forwarding in OWA - (found the same email that was receiving all sent messages)
- checked user's Outlook for VBA scripts - (blank)
What other place should I be looking?