Is there a way to see what device sent an email message? We have a user that is sending hundreds of spam emails a day and has several computers. We plan to wipe and reinstall windows but we don't want to wipe all the devices if possible.
Any other recommendations besides wipe the device?
Do you have mailbox auditing enabled for that user, specifically the Owner level? They will expose some details on the client for different mailbox-level operations. Other than that, your best bet would be the Audit logs in the SCC, which will show you login attempts.