Update: Starting November 2022, protection.microsoft.com URL does not work anymore. Please go to security.microsoft.com instead for the AntiSpam feature mentioned in this post.
We realize that many...
Updated Dec 08, 2023
Version 10.0
Blog Post
Nino_Bilic
Microsoft
MicrosoftChrisAtMaf - actually, administrator CAN modify user's OOF message without resetting the user password. It's been a few years that the functionality has been in Microsoft 365 Admin Center (Users > Active users > click on the user that has an Exchange license > Mail tab > Automatic replies).
That being said - you first have to know that this is turned on and I need to check if the Forwarding report calls this out (I would be surprised if it does not, but I will check).
Also note that users themselves will get a notification when they launch a client that their OOF is turned on. Still does not address what you mean exactly, but it is something that users will be aware of, if enabled.