Investigating Excel-Initiated Email Activity Without Sent Items Trace

I think this is where it all starts.

• ~$ = temporary Office file
• .dotm = macro-enabled Word template

This means Word macros were loaded, even if the user never noticed Word opening.

Very common when:

• Excel automates Word
• A template is referenced
• A macro runs silently
  
  How you can reproduce it yourself (quick test)
  1. Open Excel
  2. Press Alt + F11
  3. Paste this into a module:
• Sub TestSend() CreateObject("Outlook.Application") _ .CreateItem(0) _ .Send End Sub
  1. Run it
• You’ll see:
  1. Email sent
  2. No Sent Items copy
  3. Outlook.exe used
  4. Excel.exe is parent
     
     Same behavior you’re investigating.
     
     To Prevent this; 👉 Microsoft Defender for Endpoint
     
     Security settings → Attack surface reduction → Rules
     
     Enable:
     • Excel → Outlook email automation
     • Word macros sending mail
     • Office launching cmd.exe / powershell.exe
       
       Enable: Block Office apps from creating child processes → It should block.