Name & alias mismatch in eDiscovery Premium

[tgraham-legalops]

Purview eDiscovery Premium manager here. Has anyone in this forum encountered a problem where the display name for one custodian and the email address for another somehow get mixed and one of the metadata fields ends up looking like this?

Example Case:

Ren v. Stimpy

Custodian 1: Ren Hoek <rhoek@companydotcom>

Custodian 2: Stimpson J. Cat <sjcat@companydotcom>

In the list of possible senders in the review set I find:

Ren Hoek <sjcat@companydotcom>

This shouldn't be possible. There's no one in the active directory with that display name and email combination. Those are two completely separate accounts. In the actual review set that I'm managing, there are over one hundred appearances of this mismatch.

We have a ticket open with Microsoft, but the ticket isn't going anywhere. Microsoft doesn't seem to have an answer for it. We have verbal confirmation from Microsoft that it's just a display issue with Purview and that there are no actual emails going out as "Ren Hoek <sjcat@companydotcom>". But what we don't have is an explanation as to why this happened in Purview and no clear idea how to prevent it or how frequently its happening.

Exporting the files that show the mismatch via Purview's export tool shows the proper pairing of name and alias on the native file. No mismatch, so that's good. But, when downloading the files, one by one, you see the mismatch. This is, of course, a problem.

Anyone have any insight into this? Can the error be duplicated somehow? Any help would be greatly appreciated.

Edit: the only items this affects are calendar invites. All emails, chats, etc. display with the correct display name & alias.

[#2]

Ok, this has come up again. And again the results are limited to calendar invites, specifically exchange items where "message kind" = "meetings". The other commonality with the previous instance of this email alias/display name mismatch problem is that the one of the custodians in question shared their calendar with the other custodian at some point (I found proof of this through a content search on emails in their accounts that were sent to each other with the subject = "You're invited to share this calendar").

I think what's happening is when Ren Hoek <rhoek@companydotcom> shares his calendar with "view all items" permissions with Stimpy J. Cat <sjcat@companydotcom>, copies of all calendar items created by Ren appear in Stimpy's Exchange calendar folder as if Stimpy created them. In eDiscovery these are the items that appear as if the sender is this: "Stimpy J. Cat <rhoek@companydotcom>." I think that's what's happening.

Can someone from Microsoft please confirm?