Purview eDiscovery: Exported email shown as forwarded - when no other evidence of being forwarded.
eDiscovery results include an email shown as forwarded (both a blue arrow in the message list against the email, and in the copy of the email "i You forwarded this message on 04/06/2024 18.36") for which there is no other evidence of the message being forwarded. eDiscovery searches have identified no email sent from the account at or around the reported time (18.36) of the reportedly forwarded email. A Purview Audit search of the user's activity shows no matching activity around that time. Why would the message be shown as forwarded when it apparently has not been?