Weird forwarding activity

Copper Contributor

We have a weird problem.  It was reported that our client's email is acting strange.  There are two companies involved that are actually connected but have separate Exchange accounts.  Suddenly, if someone sends an email from anyone from any address to Email address removed the email is immediately redirected to the CEO: Email address removed (it's the CEO's named account.) 


After checking all accounts for forwarding rules (including on the admin level) and finding nothing, we tried sending from a account (online) to Email address removed we were shocked to see that although we typed Email address removed in the SEND box, it immediately showed up in the SENT folder as having been sent to Email address removed!  There is no indication in the SENT mail message of the address we typed, only the CEO's address!  


Anyone have a clue?


Thanks for any help!

2 Replies
Message trace (the detailed one) will give you a clue as to what's happening:
Also, you might want to check the mailbox for any stored contacts that might be overriding the address.

@Vasil Michev Thank you for your help.  We created an test message aimed at the target at Email address removed and got the usual result of the message being redirected on our Exchange server.  We traced it and got the following result: (the company name is changed of course) 


Message sent to at using TLS1.2 with AES256


This was followed by a response saying it had been submitted


Finally a third response saying:


Message received by:


And of course, the email message is listed in the sender at as having been sent to the owner of and not the ap address.


This seems to be happening on the senders side of this communication but I don't undestand why.