We are seeing some strange behavior that I am not able to explain. Specifically, it seems to be only impacting users that are using the built-in email client on iPhones.
Some symptoms:
- Meetings (often from years past or even cancelled) are reforwarded to meeting attendees
- Forwarded Emails (the users swear up and down they didnt do it, or werent even messing around on the device at the time)
We've tried to chalk this up to user error, but it is happening at a clip now that is getting a bit worrisome.
Is anyone aware of issues that might be causing this. We are investigating InTune, and the possibility of turning off access via the built-in client. But if there are known issues or others have experienced anything similar, that might speed things up.
Doing authentication analysis and message traces shows that it doesnt look like any malicious activity is occuring, emails are coming from their devices and are internally sent, users are often worried they have been hacked.
