Mail from internal user moved to junk and can not move back

[whyou]

Problem mailbox always almost move mail  ( from internal user A to(to, CC or BCC) problem mailbox ) to junk box. Not only newly received but also mails manually moved to inbox from junk.

Have checked

1. OWA rules
2. OWA blacklist
3. Outlook rules
4. Set spam filter to off or high or low in both OWA and Outlook on windows.

But nothing found. Tried to check audit log for problem mailbox which LogonTypes is Owner and  Operation is Move but shows nothing (Maybe something wrong here cause manually move mail from junk to inbox should be logged but no).

On Exchange server 2013 and Outlook 2013.

Looking forward to all idea for debugging.

And also apologize for my poor English.

[#2]

@whyou

Copy and Paste the email headers for investigation..

Specially "X-Forefront-Antispam-Report"
https://docs.microsoft.com/en-us/office365/securitycompliance/anti-spam-message-headers

Regards,

Akshay

System Admin - Apps4Rent

[#3]

@Akshay_Mane  

Modified the original topic for proper information.

Here's a problem mail header:

Received: from MBX.[Our domain] (192.168.1.206) by MBX.[Our domain] (192.168.1.206) with
Microsoft SMTP Server (TLS) id 15.0.1293.2 via Mailbox Transport; Thu, 25 Apr
2019 10:53:04 +0800
Received: from MBX.[Our domain] (192.168.1.206) by MBX.[Our domain] (192.168.1.206) with
Microsoft SMTP Server (TLS) id 15.0.1293.2; Thu, 25 Apr 2019 10:53:04 +0800
Received: from MBX.[Our domain] ([::1]) by MBX.[Our domain] ([::1]) with mapi id
15.00.1293.006; Thu, 25 Apr 2019 10:53:04 +0800
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: <[Internal user A]@[Our domain]>
To: <[someone else]@[Our domain]>
CC: <[Problem mailbox]@[Our domain]>
Subject: =?gb2312?B?suLK1A==?=
Thread-Topic: =?gb2312?B?suLK1A==?=
Thread-Index: AdT7EilzQrnSPbf3Q5y3XFXB5g17Iw==
Date: Thu, 25 Apr 2019 10:53:03 +0800
Message-ID: <522197462de04a7f8d700faad6120266@MBX.[Our domain]>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <522197462de04a7f8d700faad6120266@MBX.[Our domain]>
MIME-Version: 1.0
X-MS-Exchange-Transport-FromEntityHeader: Hosted
X-MS-Exchange-Organization-MessageDirectionality: Originating
X-MS-Exchange-Organization-AuthSource: MBX.[Our domain]
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-Originating-IP: [192.168.1.245]
X-MS-Exchange-Organization-Network-Message-Id: f216c941-2249-4ace-f9d0-08d6c929234d
Return-Path: [Internal user A]@[Our domain]
X-MS-Exchange-Organization-AVStamp-Enterprise: 1.0

[#4 · Accepted solution]

Got the answer!

Problem solved by deny access of a mobile app called MyMail. Still don't know this is a bug or wrong configuration.