Email Trace

[Pn1995]

I have Office365 business and I've just been informed by one of our customer that in Nov 2018 they got a email from us providing them with details of a new bank account that was to used for payment. 

This has only recently come to light and as it was over 90 days ago I can't do any email traces from within Office365.

The email header is below. The email looks like it has come from us. Is there anyway to check if this has come from a Outlook email account within our company? Or can we tell if it was sent from maybe a SMTP connected email?

email header with email removed....

Received: from BN6P154MB0033.NAMP154.PROD.OUTLOOK.COM (2603:10b6:903:77::30)

 by CY4P154MB0044.NAMP154.PROD.OUTLOOK.COM with HTTPS via

 CY4PR06CA0044.NAMPRD06.PROD.OUTLOOK.COM; Wed, 17 Oct 2018 15:43:01 +0000

Received: from BN6P154CA0008.NAMP154.PROD.OUTLOOK.COM (2603:10b6:423:70::18)

 by BN6P154MB0033.NAMP154.PROD.OUTLOOK.COM (2603:10b6:423:70::20) with

 Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1228.27; Wed, 17 Oct

 2018 15:42:59 +0000

Received: from AM5EUR03FT048.eop-EUR03.prod.protection.outlook.com

 (2a01:111:f400:7e08::204) by BN6P154CA0008.outlook.office365.com

 (2603:10b6:423:70::18) with Microsoft SMTP Server (version=TLS1_2,

 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1228.27 via Frontend

 Transport; Wed, 17 Oct 2018 15:42:59 +0000

Received: from mx0a-00240e01.pphosted.com (148.163.149.44) by

 AM5EUR03FT048.mail.protection.outlook.com (10.152.17.177) with Microsoft SMTP

 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

 15.20.1250.12 via Frontend Transport; Wed, 17 Oct 2018 15:42:58 +0000

Received: from pps.filterd (m0114529.ppops.net [127.0.0.1])

by mx0a-00240e01.pphosted.com (8.16.0.22/8.16.0.22) with SMTP id w9HFdLpn027672

for <removed@removed>; Wed, 17 Oct 2018 11:42:56 -0400

Received: from pps.reinject (localhost [127.0.0.1])

by mx0a-00240e01.pphosted.com with ESMTP id 2n66b4rff6-1

(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT)

for <removed@removed>; Wed, 17 Oct 2018 11:42:56 -0400

Received: from pps.reinject (m0114529.ppops.net [127.0.0.1])

by pps.reinject (8.16.0.20/8.16.0.20) with SMTP id w9HFgRF6030296

for <removed@removed>; Wed, 17 Oct 2018 11:42:56 -0400

Received: from nam02-bl2-obe.outbound.protection.outlook.com (mail-bl2nam02on0120.outbound.protection.outlook.com [104.47.38.120])

by mx0a-00240e01.pphosted.com with ESMTP id 2n66b4rew9-1

(version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT)

for <removed@removed>; Wed, 17 Oct 2018 11:39:10 -0400

Received: from DM5PR16MB0041.namprd16.prod.outlook.com (10.172.92.8) by

 DM5PR16MB0075.namprd16.prod.outlook.com (10.172.89.23) with Microsoft SMTP

 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

 15.20.1228.24; Wed, 17 Oct 2018 15:39:03 +0000

Received: from DM5PR16MB0041.namprd16.prod.outlook.com

 ([fe80::d54e:ab92:4038:aa30]) by DM5PR16MB0041.namprd16.prod.outlook.com

 ([fe80::d54e:ab92:4038:aa30%5]) with mapi id 15.20.1228.032; Wed, 17 Oct 2018

 15:39:02 +0000

From: <removed@removed>

To: (removed)@(removed)>

Subject: Re: Follow up

Thread-Topic: Follow up

Thread-Index: AQHUZisAhJsJdYlsJkqWcemRTH4yxqUjijqQgAAIOLM=

Date: Wed, 17 Oct 2018 15:39:02 +0000

Message-ID:

 <DM5PR16MB00413508FA4ED1E2369E7C3EC7FF0@DM5PR16MB0041.namprd16.prod.outlook.com>

References:

 <DM5PR16MB0041C9F776365D3A102915CCC7FF0@DM5PR16MB0041.namprd16.prod.outlook.com>,<CY4P154MB00448F9ACAEE27B6A3ED6B5EE5FF0@CY4P154MB0044.NAMP154.PROD.OUTLOOK.COM>

In-Reply-To:

 <CY4P154MB00448F9ACAEE27B6A3ED6B5EE5FF0@CY4P154MB0044.NAMP154.PROD.OUTLOOK.COM>

Accept-Language: en-US

Content-Language: en-US

X-MS-Exchange-Organization-AuthSource:

 AM5EUR03FT048.eop-EUR03.prod.protection.outlook.com

X-MS-Has-Attach: yes

X-MS-Exchange-Organization-Network-Message-Id:

 661d3c6a-4782-486d-894f-08d6344736e1

X-MS-Exchange-Organization-SCL: -1

X-MS-TNEF-Correlator:

x-originating-ip: [155.94.250.23]

x-ms-publictraffictype: Email

x-forefront-antispam-report:

 CIP:148.163.149.44;IPV:NLI;CTRY:US;EFV:NLI;SFV:SFE;SFS:;DIR:INB;SFP:;SCL:-1;SRVR:BN6P154MB0033;H:mx0a-00240e01.pphosted.com;FPR:;SPF:None;LANG:en;

received-spf: None (protection.outlook.com: removed.net does not designate

 permitted sender hosts)

dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

 d=advmetal.onmicrosoft.com; s=selector1-removed-net;

 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

 bh=g+0OMTrUoMg3lweT/rqWN8iyDgsSuYOfDVA8UDLjLFI=;

 b=gk/CCFpXDpaiQWDPIJjY98Qn6fh5s6lPTQ7tgnVQojmUW87fFXtl1iDJYgePW9AotPcuYWVe05nXSUawTILkEtq0JZoW3+evKObPNUiawXJ3H9nuCqK7x+KTCsoqq07d4mazxVXBxkgLduQwAtN+QtSHMvpcpuPD/7IBs8XweFg=

authentication-results: spf=fail (sender IP is 148.163.149.44)

 smtp.mailfrom=removed.net;removed.com; dkim=pass (signature was verified)

 header.d=advmetal.onmicrosoft.com;removed.com; dmarc=none action=none

 header.from=removed.net;compauth=pass reason=115

x-proofpoint-virus-version: vendor=fsecure engine=2.50.10434:,,

 definitions=2018-10-16_14:,, signatures=0

authentication-results-original: ppops.net; spf=pass

 smtp.mailfrom=(Removed)@(removed); dkim=pass header.d=advmetal.onmicrosoft.com

 header.s=selector1-removed-net; dmarc=none

x-microsoft-exchange-diagnostics-untrusted:

 1;DM5PR16MB0075;6:8ErN2MVCHSD2D16Wl+4RlHFMDveElWSFotx9rIrQbQL91giJhvm7BEDdu1Udb6EepyjGuBzsxw+68p+Bmh8KEaGXtKRQ7wSvkgBzxWtwEaL+ssDWah8rzoLJbmI8JM6Nreh7LDGMXX2dzWNya7BQb/dl1CA8GF6dvXafGrwuUL97O5GAqbyw6rsCjTT3aXq3kKrlw8ywriFMygqnV2393YFe5xH4KllHocI1xgsNW7eHn3trLrGgkwUjnue+eCz2GLAQPJlwuKscZ4HhKBt8xgrtLo6YFsibYXqFhYn2U8Xy48Ws4HOVlIodV6MjBk2m/uNHwTg6ubD92Tq1KPSMRYqTHON9GnBp2kCRRmxr4MCfQEP8NouC4pUOkBbdbrUkbA1FmXG1G9DUEsPrzzZHsgZo2NTfWVIuBoW10A3nZekglPpgcj37XJP2uhylxAHCr69mFHj+JtAcb60UgzfjpA==;5:mza9ZMo+BRSVzaur5Q/HINgZ4R0B2xqeTHffKwyrPz7uVZJ2DwlMersOaYRRR0ANxjnR3N/0/zBxbdAZfccBJF1kZO7Jgz2Lpd/H+UTYUcNdLQf5ZFe4+2n8ZaxOG14Sh6bpmIXkW7cteDqOue8/eNY+oKrjLfV9HQ4XYUlexxk=;7:/QwgHHsxqrQvY4rNuf7/tpM9bOjqlvwwli4NLVLYE7ly/JwYJV7mA96uV/1xA3jxZj0YoV3gYEnZR4qOWlSvJqW/5ZNAe9lWSpiHjTXkyODJ76A6mw73wjz9vnpiABhdECrQJNk4piqGXLL5fFctJ1Xj1iA7QEZbhrIyNRHHIE7/FHpiUl4NA87z0YbJkJKYu1kRv4pzzkItld20H9LIFdiaz1X1TwfkXIxKV3niSPQa5BlNdXQ5mtMhNJDJ9/Fr

x-ms-office365-filtering-correlation-id: 661d3c6a-4782-486d-894f-08d6344736e1

x-microsoft-antispam-untrusted:

 BCL:0;PCL:0;RULEID:(7020095)(4652040)(7021145)(8989299)(5600074)(711020)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7153060)(49563074)(7193020);SRVR:DM5PR16MB0075;

x-ms-traffictypediagnostic: DM5PR16MB0075:|BN6P154MB0033:

x-microsoft-antispam-prvs:

 <DM5PR16MB0075A272BADB0F03323EDCBDC7FF0@DM5PR16MB0075.namprd16.prod.outlook.com>

x-exchange-antispam-report-test:

 UriScan:(50479424662132)(4376648964400)(229409888891308);UriScan:(50479424662132)(4376648964400)(229409888891308);

x-ms-exchange-senderadcheck: 1

x-exchange-antispam-report-cfa-test:

 =?Windows-1252?Q?BCL:0;PCL:0;RULEID:(102415395)(6040522)(2401047)(8121501?=

 =?Windows-1252?Q?046)(5005006)(3231355)(944501410)(4983020)(52105095)(300?=

 =?Windows-1252?Q?2001)(10201501046)(93006095)(93001095)(149066)(150057)(6?=

 =?Windows-1252?Q?041310)(20161123560045)(2016111802025)(20161123558120)(2?=

 =?Windows-1252?Q?0161123562045)(20161123564045)(6043046)(201708071742011)?=

 =?Windows-1252?Q?(7699051)(76991095);SRVR:DM5PR16MB0075;BCL:0;PCL:0;RULEI?=

 =?Windows-1252?Q?D:;SRVR:DM5PR16MB0075;BCL:0;PCL:0;RULEID:(8211001083)(10?=

 =?Windows-1252?Q?2415395)(2018062399030)(2018011200283)(2401047)(7630418)?=

 =?Windows-1252?Q?(8121501046)(52410047)(2018011210174)(2018011211064)(201?=

 =?Windows-1252?Q?8011212028)(2018011213028)(2018011214028)(2018011215028)?=

 =?Windows-1252?Q?(2018011216028)(2018011217028)(2018011218028)(2018011219?=

 =?Windows-1252?Q?092)(2018011220252)(2018011221063)(2018011222027)(201801?=

 =?Windows-1252?Q?1223027)(2018011224027)(2018011225035)(2018011229035)(20?=

 =?Windows-1252?Q?18011232269)(2018011233052)(2018021202149)(98810176)(201?=

 =?Windows-1252?Q?8021203149)(98815176)(7631346)(7632307)(7633261)(1430482?=

 =?Windows-1252?Q?)(1431068)(1432130)(1440239)(823300264)(823350442)(82341?=

 =?Windows-1252?Q?1253)(9101536074)(93006095)(93001095)(10201501046)(30020?=

 =?Windows-1252?Q?01)(3231355)(901025)(902075)(913088)(7045084)(944500087)?=

 =?Windows-1252?Q?(944510158)(944921075)(946803086)(946901078)(9300000249)?=

 =?Windows-1252?Q?(9301004277)(4983020)(4982022)(52103095)(52105095)(52106?=

 =?Windows-1252?Q?170)(52408095)(98821027)(98822027)(52401380)(52601095)(5?=

 =?Windows-1252?Q?2606095)(52505095)(52406095)(52305095)(52206095)(8886224?=

 =?Windows-1252?Q?0)(88860193)(1102011)(1610001)(8301001075)(8301003183)(2?=

 =?Windows-1252?Q?01708071742011)(7699051)(76991095);SRVR:BN6P154MB0033;BC?=

 =?Windows-1252?Q?L:0;PCL:0;RULEID:;SRVR:BN6P154MB0033;?=

x-forefront-prvs: 08286A0BE2

x-forefront-antispam-report-untrusted:

 SFV:NSPM;SFS:(10019020)(346002)(376002)(39840400004)(136003)(366004)(396003)(199004)(189003)(6116002)(3846002)(99286004)(19627235002)(6606003)(6916009)(316002)(71200400001)(71190400001)(68736007)(5024004)(2900100001)(74316002)(221733001)(256004)(14444005)(25786009)(66066001)(86362001)(6506007)(53546011)(2906002)(76176011)(7696005)(7736002)(229853002)(102836004)(105586002)(33656002)(6436002)(8936002)(99936001)(97736004)(106356001)(19627405001)(19273905006)(11346002)(446003)(81156014)(3480700004)(81166006)(508600001)(476003)(14454004)(53936002)(486006)(5250100002)(186003)(55016002)(8676002)(6246003)(5660300001)(26005)(7116003)(236005)(9686003)(6306002)(54896002)(606006)(362424003);DIR:OUT;SFP:1102;SCL:1;SRVR:DM5PR16MB0075;H:DM5PR16MB0041.namprd16.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:0;MX:1;

x-microsoft-antispam-message-info-original:

 RwyzSoIxcGCQBXq5kK5X03BoLs797sLnSAIwHigUDjwFZzmUDPx2RwwpUvt4I4pozfhFxG8Xbjj/CEVBYECGpmSP+ifxa4cu2sv9Q/BgvUIkvWGuC2D8FGQ9p6puQaYxBsCD9OAbmdFJd0cN2ZjJtgwIhs3BVy5ItKrcifQHUomKpYxcI70DBwLJNPUytqlDClVuf/18Gd2hL4LUHFpwyFp1LBlThpfYHe+EtGNvdUL7r3Db/YByxVTtZEFkhGK4sOfJZS+DldPwtMS+9ydJlzlcND2WAX3Sjeyri3VWEvfbAP5PR2NRNY0IGpPO7arr/Jwc71V8putBQ3hQPvrDNunvJdrFRXNlmOaNwdvyOaY=

spamdiagnosticoutput: 1:3

x-ms-exchange-transport-crosstenantheadersstamped: BN6P154MB0033

x-clx-shades: MLX

x-clx-response: 1TFkXGxMbEQpMehcbGBwRCllNF2dmchEKWUkXGnEaEBp3BhsdG3EfGhAadwY

 YGgYaEQpZXhdoY3kRCklGF0NETU9YWUVGRnVCRVleT04RCkNOF356ZH8ZB0J9SU1SWHVGa09Mb1

 5HElx1a2FgZR5tSUlEEQpYXBcfBBoEGx8bB0gaSBwTSUwfBRsaBBsaGgQeEgQbEBseGh8aEQpeW

 Rd5BXoaSBEKTVwXGBgdEQpMWhdpa11rEQpNThdpaxEKTEYXb2tra2xraxEKQ1oXGxoeBB4dBBkS

 BBsYGhEKQl4XGxEKQlwXGhEKQkUXYR5FTRNQa1ITUHIRCkJOF2t4X2VMT1phckdMEQpCTBdkSRk

 eTmhCHUtlTxEKQmwXbmNhfWBsHE1zEm8RCkJAF2UBeERHHWgda2EbEQpCWBdgQG5gBXwfHxxmfB

 EKTV4XGxEKWlgXHREKcGcXbGB4E0ZYTgVveH8QGRoRCnBoF2seaVtPeXJ5UEVoEBkaEQpwaBdve

 B8YU155ZEVfExAZGhEKcGgXa0d7G3lmZ04TQGUQGRoRCnBoF2JaR2wee2wfWXBLEBkaEQpwaBdt

 RVxfGXpeQUVzaxAZGhEKcGcXZ2toemRnZUZGem8QGRoRCnB/F2JyRk5tUGd4XGIdEBsZGhEKcF8

 XbEhBQnNZU1xSQ00QGxMbEQpwfRdgYR1sX1xcUFMfYRAbHR4RCnB9F2BhHWxfXFxQUx9hEBsdHh

 EKcGsXbB8YYRhIbkRrZkAQGRoRCnBLF3p4bkJjGU5FBRtQEBkaEQpwbBdrexlDeBtoc314WBASH

 xEKcEwXa0NpRUJGQH5eTVsQGRoRCm1+FxsRClhNF0sRIA==

x-proofpoint-spam-reason: safe

x-eopattributedmessage: 0

x-eoptenantattributedmessage: abf9983b-ca77-4f20-9633-ca9c5a847041:0

x-ms-exchange-transport-crosstenantheadersstripped:

 AM5EUR03FT048.eop-EUR03.prod.protection.outlook.com

x-ms-office365-filtering-ht: Tenant

x-microsoft-exchange-diagnostics:

 1;BN6P154MB0033;6:RDs09mBtkh/ejavSbq1Qy7mfaIi8OTWq+ujX0AzskXaJW4eG+RNKpEDLtxar2LNkd4Hjt5c4cGvBcW7Gm3on0Pr/ahfMJjo/XM64Y+3O0fjpyR+/RvmFFSOAukkZSRw1779xp1Oev+FuZvZBSOuJi2TciCnkylFh3s51vSoB+n+0jNdD+WEzBurI3+r3Ol0ebOvSDiviDjxQfDl/6krarypFvjE8Vysn6HuNnXXm+oI9ZyDWyfKK9jPEWbHoOzkVuQRTpWRTtlpo+ZCC5000Srp0nVzOqLiy1P9ogxlpt16gpJybvNE5//hTpEA0qAiSY5og1l+VvToq1TzKCneJRz0WSAapHe8lGAiW9cZTDjZwM4UnJOj63HgzRv+I1lDeByl8Z7yCLb7AkhHm9wYMFmuTLxWANXqgaAJx/SQhRnPtPrvaEmJcsWP/4jBY9q95t1GuXgWJa/gBXgO7qBwaQA==;5:SRDbJFCjdw3lOPrj9iMJy6yRvUt1DanQas3brJBlQdfxGPR+5xaX5sFz5ajoW8MOnZqG/zkSbNLTQF7+rBHYFAEVDbfXz5DhZBEwFaAjPk5r6HNMcLbslClQVNP5bAUJ5MO8mb0d/hf6KZSy8kzyMyloBdcak5E0p6B7PuBvESg=;7:j/rOzuNAxcQTn/+L2LrNifG+xVqedbJPdEKHzt7h3XZnW6bKagcHph2EPo9K/89ihQzJlXTxVfJ1lgl9sKVqiMu3ikZ73cCgLwrX6jQWMujQn68uNnAqcOE1gCfMeGC06u0pvnwXl2FASnNUKTfBIKfgrhmnY5s8aYysDGnGSr/FY5AjCyK3tbTsFutS5NimgaewDweDtPbngm+uViNkQVkmQQhr+UTXvhBmlxG2dnOuBJMy/vIOsCtXHMqIpXkD

x-ms-office365-filtering-correlation-id-prvs:

 0aa51a29-66e7-44b6-d714-08d63446aa4a

x-microsoft-antispam:

 BCL:0;PCL:0;RULEID:(7020095)(4652040)(5600074)(710020)(711020)(4605076)(49563074)(1401270)(8001031)(1420028)(1417108)(71702078)(7193020);SRVR:BN6P154MB0033;

x-microsoft-antispam-message-info:

 =?Windows-1252?Q?PNwHdragiz5NOUdiLKx4m4mZ8Rh/KxfAZ7wtfszjLK32DVZ6jOgpxxiJ?=

 =?Windows-1252?Q?7tYligHpOFK34Y21hNfHNtuqMI7/wkLaW2Poh3umcWqGASvMl+sDFzik?=

 =?Windows-1252?Q?daJUgWJCt7nwV2zh9fYEkzCzZEJUM9T1Dx4ceqIfOH3rid5cKlbuXHVY?=

 =?Windows-1252?Q?PQ19gYNHjAh8PLs8llyAbMDe9ueqas+cRjvL2PLwvRpJrl9gjzbLVp5F?=

 =?Windows-1252?Q?oDrZ8Zp9oeFWXhZA1KEgNVliVh5G7cZa98Wsd9BKppTBZiuDC4pXs3Eg?=

 =?Windows-1252?Q?/E7djx+AI3FmMbIuY3GREVIwGd73iA7TrvENRqbxQg1qyQaOghL5XhjU?=

 =?Windows-1252?Q?8I33QVXjazB4q9tXWmMsOtnLBsBJbUHLzlyAayiKOtUEuWSPdvvwVDey?=

 =?Windows-1252?Q?a+tE89hIIqgIWg0iuz3+tuvNeiehMztb3MZ2wrxg7IDAAlgEVt8IQ6Bx?=

 =?Windows-1252?Q?82sYTnIMnNMpiRha40+5Tbc2GlyB9V9czkTzH/HnbUzXOoMON5scPtSs?=

 =?Windows-1252?Q?Pl0JSRmSHV9qljct6lOZakEVRyglpN8mVxdjVqn/ovFdBACPr+Pui3P/?=

 =?Windows-1252?Q?3x3ZHs+kgQwAbvrGlDhCn8k3cjCezJBmw8fCbPg22f2debDfg72eZ3bM?=

 =?Windows-1252?Q?XsAqkj70ElBCUbVTXdWKmEVNQfXTPMTAVAmXtNBl4QdiHFi7xkzeSJ9y?=

 =?Windows-1252?Q?Och0bHXE3KQ49vWr5hTMk74lbGlpx5LC0gmQF4eNWOYAgtN3QoV0R84J?=

 =?Windows-1252?Q?djCcvCqlqkp87aJYDeE6058iEEEuMNwToyct1XtDibaNzaYb7rQf60+c?=

 =?Windows-1252?Q?l3hnrhZNvG1dc7H3KrgLVgwOGQNTvmghd7TIt2VTp9cVxBc5qXBBBf95?=

 =?Windows-1252?Q?ZuhfX+ZQ+YfrevpJtNOL6RKqnGXN91zwB4gX5A+VBP4oSZQp47sFcnj0?=

 =?Windows-1252?Q?47zU97wxKffxyluOoZAr+zAOZcdshD83Z0xsM5FDrbp3QmDbTr40hxxg?=

 =?Windows-1252?Q?GG1zDUZ6WiwLmfJr2RusN5E01YvMKwYSJol2APsI4mCywLuKcaRbBKw9?=

 =?Windows-1252?Q?MQJP70Z3oKdg+gh9w4oofEZVFi7xc9Z0QR7wFw=3D=3D?=

x-ms-exchange-crosstenant-originalarrivaltime: 17 Oct 2018 15:42:58.0857 (UTC)

x-ms-exchange-crosstenant-network-message-id:

 661d3c6a-4782-486d-894f-08d6344736e1

x-ms-exchange-crosstenant-id: abf9983b-ca77-4f20-9633-ca9c5a847041

x-ms-exchange-crosstenant-fromentityheader: Internet

x-ms-exchange-transport-endtoendlatency: 00:00:03.0640563

x-ms-exchange-processed-by-bccfoldering: 15.20.1228.020

X-Microsoft-Exchange-Diagnostics:

 1;CY4P154MB0044;27:uAbRBJDG5UBLUuYg26lAXqA3d9EQkD2ZPkxX2eqvWJTGE5r0QRFdVNaIZIyJhrZQqcltd0+EY0zPYxQuJcQ1gn/rB5GwirymL3dpR9ld+lTjTmaITE269UNm72RN8a9ghvAr+djikntZkN23ilPp4cqqy8egTxzkkvcRS1D80RjlahPrhs1GzN9+gfKy/QYeo2Mt+nMjuePzm/RKKt6uORbmZZCEVdqOtqXhDR3gC++unPdLcTPi74iYj7vAPdnenPoW78cM+9u1tP/uo/2G2R9EJt9GBqKf05M3rSGEkB5s/BMLwZkh2cCdtRZopI81vHyHsdlefwks8AmKNnIfgflyXwTqvPVr8n8IPjXcgzJywx2L3FGLB+hc77bjzXfAYHVQGaKJROhF3cKomYNGIKpx5xVUInCLucE24+mLziP4EwPAwNmVNA26YCS7it5H

X-Microsoft-Antispam-Mailbox-Delivery:

 abwl:1;ucf:0;jmr:0;ex:0;auth:0;dest:I;ENG:(750119)(520011016)(520006050)(702028)(944506303)(944626516);

X-Microsoft-Antispam-Message-Info:

 =?Windows-1252?Q?lzORpj9qkJEQRcSjzLw657GvlWfgRMjYC4Aoo9EP7Lt2zcncmgCdayKJ?=

 =?Windows-1252?Q?xl4hcwnIEOlLoJVUQcDOAKnYsANqoZMWD0vCSe0hQO1VcUd8BNFenry7?=

 =?Windows-1252?Q?196pDATUqQyZvm10w2qDG6kKSsWW3KDTDA3SkzwYsRG6z5663kXGv2kr?=

 =?Windows-1252?Q?L7oemyk+zEHn4GRxUqyN80KbiDiwzk/jiq4BuycHcPt/CSNi1c4r3ak3?=

 =?Windows-1252?Q?zKOwy6FSELEG7flTX2N6ppyuqGvVMqOsbq0OsU0jBr1uAlMv/myP8P4O?=

 =?Windows-1252?Q?JDOP5FiZJ5ZbxQrUfW7u/tTLZf0TCT2LZONKOTlBbdMghcMHyvQ+YgPz?=

 =?Windows-1252?Q?JwXcpCiHPKAaCaztwmjbq3sIMEjsY8PSV1gE0y0/bux+Fu8MzBJr/wA3?=

 =?Windows-1252?Q?xlbpNCFaIIwa+CyPmRW3JEl8UkvNayFYrIn5wizAYdLQhi/ruYPj4tQz?=

 =?Windows-1252?Q?TO/tcmdDG6OFgghy84CjmlF9/Yg+QemOZ6WgzH3wPEX9Hir7fgRXJ2MY?=

 =?Windows-1252?Q?nEfLrAo6Li5NznhIRQY4hXcwIB6KTooBLNknKA3E//rqAiG8G7YF2wj2?=

 =?Windows-1252?Q?0ZKBZm6Fm5pTNpNtdenu/fb9Gkapjb1XXjtAoIT25mxtOV8mZwP13NcH?=

 =?Windows-1252?Q?1BSNX+dDXJ3VXH19mRtxF3if3C5vA/CuiRz6K8uKylsx68rffOTi7gJs?=

 =?Windows-1252?Q?SCoTPqa/NHpmMPk7Pcfas0JGWMhAwmRHjNx+KSlMCi8w8fO3uXIaapVZ?=

 =?Windows-1252?Q?eVdIPDhYNFo/CQTwEHj+VHtJpMTFpksKgy2IvAgu9ocSgXdVJZmuH6lZ?=

 =?Windows-1252?Q?0Myu/6Nrp+0AAt06K7DR/1p6h0x4ihBwfxCdzWQL3faXcvmVQT6gIrQc?=

 =?Windows-1252?Q?0r8idmtyGf06RPPVPxXcCbqZDp3vxxQS8SAE3zvQIYrNoIV2KQzCpD7Z?=

 =?Windows-1252?Q?jw4mdcdFgNbXAlylAEe92+rZ1wqtN56iUzkMbkqPpjP7+VOEMhd7ZqmU?=

 =?Windows-1252?Q?NQm7uW2nxq+iE9ee9IV4iC4gx6xwwsPGi2sKOgO0Ex/rcK6TAJTMLahp?=

 =?Windows-1252?Q?LN2HH33xI9M0wAffcjJ0cW3NDjEmfKXcCSJXmeAoF51e0folA9uOXBGG?=

 =?Windows-1252?Q?hLvKraZq7OWe18wLTt7oFKfebNuvtc/KJKvblMuv+VyC4Q=3D=3D?=

Content-Type: multipart/mixed;

boundary="_004_DM5PR16MB00413508FA4ED1E2369E7C3EC7FF0DM5PR16MB0041namp_"

MIME-Version: 1.0

[#2]

You may not be able to do a trace route, but you should be able to find the e-mail in security and compliance search for the user that sent it mailbox. If it's there it's most likely a phishing scheme that your user was compromised and they used the account via webmail to send out targeted messages. Seen it before.