User said she did not send the calendar invite

%3CLINGO-SUB%20id%3D%22lingo-sub-816092%22%20slang%3D%22en-US%22%3EUser%20said%20she%20did%20not%20send%20the%20calendar%20invite%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-816092%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20may%20be%20a%20bit%20of%20a%20long%20shot.%20Hoping%20someone%20had%20something%20similar%20happen%20to%20them.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20user-1%20who%20sent%20an%20invitation%20as%20a%20shared%20mailbox%20to%20a%20listserv.%20Several%20recipients%20of%20the%20message%20reported%20that%20the%20same%20message%20came%20from%20a%20user-2%20email%20address.%26nbsp%3BThe%20user-2%20said%20she%20a%3CEM%3Ebsolutely%20did%20not%20send%3C%2FEM%3E%26nbsp%3Bthe%20calendar%20invite%20to%20the%20listserv.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20user-1%20sent%20us%20the%20calendar%20invite%20with%20message%20headers%20intact.%20Sender%20is%20user-2.%20The%20originating%20IP%20is%20from%20an%20external%20source.%20We%20looked%20at%20message%20tracking%2C%20external%20IP%20was%20verified%20as%20the%20sending%20IP%20from%20user-2.%20Audit%20logs%20does%20not%20show%20anything%20outside%20the%20user-2%20sending%20the%20calendar%20invite.%20But%20she%20is%20insisting%20she%20did%20not%20send%20the%20invite.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%20There%20are%20no%20delegations%20on%20user-2's%20mailbox%3C%2FP%3E%3CP%3E2.%20It%20happened%20before%2C%20around%209%20months%20ago%2C%20according%20to%20the%20department%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20on%20office%20365%20Exchange%20online.%20Auto%20discovery%20is%20to%20the%20cloud.%20User-1%20and%20User-2%20are%20in%20the%20same%20department.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-816092%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOutlook%20Calendar%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-818553%22%20slang%3D%22en-US%22%3ERe%3A%20User%20said%20she%20did%20not%20send%20the%20calendar%20invite%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-818553%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F347578%22%20target%3D%22_blank%22%3E%40Juan_CUMC%3C%2FA%3E%26nbsp%3BThat%20is%20truly%20a%20mystery%20to%20me%2C%20and%20it%20probably%20needs%20more%20investigation%20to%20determine%20the%20cause.%20I'd%20recommend%20creating%20a%20support%20ticket%20through%20the%20normal%20channels%20and%20asking%20them%20to%20investigate%20the%20logs%20to%20see%20exactly%20what%20happened.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

This may be a bit of a long shot. Hoping someone had something similar happen to them.

 

We have user-1 who sent an invitation as a shared mailbox to a listserv. Several recipients of the message reported that the same message came from a user-2 email address. The user-2 said she absolutely did not send the calendar invite to the listserv.

 

The user-1 sent us the calendar invite with message headers intact. Sender is user-2. The originating IP is from an external source. We looked at message tracking, external IP was verified as the sending IP from user-2. Audit logs does not show anything outside the user-2 sending the calendar invite. But she is insisting she did not send the invite.

 

1. There are no delegations on user-2's mailbox

2. It happened before, around 9 months ago, according to the department

 

We are on office 365 Exchange online. Auto discovery is to the cloud. User-1 and User-2 are in the same department. 

1 Reply
Highlighted

@Juan_CUMC That is truly a mystery to me, and it probably needs more investigation to determine the cause. I'd recommend creating a support ticket through the normal channels and asking them to investigate the logs to see exactly what happened.