This may be a bit of a long shot. Hoping someone had something similar happen to them.
We have user-1 who sent an invitation as a shared mailbox to a listserv. Several recipients of the message reported that the same message came from a user-2 email address. The user-2 said she absolutely did not send the calendar invite to the listserv.
The user-1 sent us the calendar invite with message headers intact. Sender is user-2. The originating IP is from an external source. We looked at message tracking, external IP was verified as the sending IP from user-2. Audit logs does not show anything outside the user-2 sending the calendar invite. But she is insisting she did not send the invite.
1. There are no delegations on user-2's mailbox
2. It happened before, around 9 months ago, according to the department
We are on office 365 Exchange online. Auto discovery is to the cloud. User-1 and User-2 are in the same department.
