Thousands of Sent Items moved to Deleted Items, no rules, no retention

Hello everyone,

I'm investigating a very unusual Exchange Online mailbox issue and would appreciate any insights from anyone who has seen something similar.

Environment

• Exchange Online (Microsoft 365)
• Mailbox: User mailbox
• Outlook for Mac
• Outlook for iOS
• Outlook Web (OWA)

Incident Summary

On August 13, 2026, approximately 4,997 messages were moved from:

The activity occurred over roughly a 3-hour period.

Mailbox audit logs show thousands of:

Operation: MoveToDeletedItems

events.

Hourly breakdown:

01:00 - 2,046 events

02:00 - 1,540 events

03:00 - 1,408 events

Audit Findings

All sampled audit events show:

LogonType = 0 (Owner)

UserId = affected mailbox owner

Result = Succeeded

I sampled 5,000 records and all of them were:

LogonType = 0

No events were recorded as:

LogonType = 1 (Admin)

LogonType = 2 (Delegate)

Source and Destination Folders

Examples from mailbox audit records:

Folder : \Sent Items

Destination : \Deleted Items

Operation : MoveToDeletedItems

Message Trace Findings

Extended Message Trace was performed on one of the affected emails.

The trace confirmed:

CopiedToSentItems=True

DeleteAfterSubmit=False

which indicates:

• The email was successfully sent.
• The email was copied to Sent Items.
• Exchange did not delete the message during transport.

So the message existed in Sent Items and was later moved to Deleted Items by a mailbox operation.

Rules Investigation

Checked:

Get-InboxRule -Mailbox <mailbox> -IncludeHidden

Findings:

• No Inbox Rules targeting Sent Items.
• No hidden Inbox Rules targeting Sent Items.
• Only two legitimate rules that delete messages from specific Jira/Confluence senders.

Delegation Investigation

Mailbox permissions reviewed.

Known permissions exist, but mailbox audit logs show:

5000/5000 sampled events = LogonType 0

Therefore:

• No evidence of delegate activity.
• No evidence of administrative activity.

Retention / Compliance Investigation

Checked:

Get-Mailbox

Get-RetentionPolicy

Get-RetentionPolicyTag

Get-RetentionCompliancePolicy

Get-RetentionComplianceRule

Findings:

• No Sent Items retention tag.
• No retention policy targeting Sent Items.
• No Purview retention/compliance policy appears to explain this behavior.
• Activity pattern does not resemble normal retention processing.

Add-ins Investigation

Mailbox add-ins:

Polls

Share to Teams

Send to OneNote

Action Items

Bing Maps

My Templates

Unsubscribe

No third-party mailbox-management or archiving add-ins found.

Client Information Seen During Investigation

Examples observed in mailbox audit logs:

Client=OutlookService;MacOutlook/16.112

a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; }

What Has Been Ruled Out

✅ Admin activity

✅ Delegate activity

✅ Inbox Rules

✅ Hidden Inbox Rules

✅ Outlook add-ins

✅ MRM retention policies

✅ Sent Items retention tags

✅ Purview compliance retention policies

✅ Exchange transport deleting the messages

Question

Has anyone encountered a similar case where:

Thousands of messages were moved from Sent Items to Deleted Items

Operation = MoveToDeletedItems

LogonType = 0 (Owner)

No rules

No retention policy

No delegate activity

particularly involving:

Outlook for iOS

Outlook for Mac

Client=OutlookService

Any similar experiences, findings, or recommendations would be greatly appreciated.

As we need to know the root cause for this issue. 

Thanks