Yesterday I changed from Forms Based Authentication to Windows Integrated on Exchange owa and ecp. Today a couple of users noted that when they opened webmail they got presented with other users' mailboxes. After a few refreshes they got in to their own mailbox.
As far as I know and can find they should have no permissions to open these other mailboxes.
Obviously I had to revert to FBA and after that everything seems to be fine again.
Exchange 2019 CU12 Mar23SU on Windows Server 2019