Thousands of Sent Items moved to Deleted Items, no rules, no retention

Thank you for the feedback.

We have already reviewed the mailbox audit logs extensively for the incident period and confirmed the following:

• Approximately 4,997 MoveToDeletedItems operations affected messages in Sent Items.
• All sampled records show LogonType = 0 (Owner).
• No Inbox Rules (including hidden rules), retention policies, compliance policies, delegate activity, or administrative actions were identified.
• Message Trace confirms affected messages were successfully copied to Sent Items (CopiedToSentItems=True, DeleteAfterSubmit=False) and were not removed by Exchange transport.
• Audit records associated with the bulk Sent Items deletion activity consistently show:

Plain Text

1

ClientInfoString:

2

Client=OutlookService;MacOutlook/16.112.26081010;

3

4

ActorInfoString:

5

MacOutlook/16.112.26081010 (ARM64 Mac OS X 26.5.2 Build 25F84)

Show more lines

We agree that LogonType=0 does not identify the specific user action performed, and that mailbox auditing alone does not conclusively identify the exact physical device. However, Microsoft Support has already indicated that they have seen similar Outlook for Mac cases, so we are currently working with Microsoft to correlate affected Message IDs and audit records with their backend telemetry.

At this stage, the evidence points to a client-originated mailbox action rather than retention, transport, rules, delegation, or server-side processing.