Mail bypassing inbox & deleted items box?

[irbk]

I have a user who calls today saying that she's not getting e-mail from a particular sender. I check Exchange 2010's message tracking logs and find that the sender did in fact send the user 2 messages. Looks like the server successfully received the messages, but the user claims to not have ever got them. I open up the users account and sure enough, there are no messages from the sender. Finally, I get the users password and log onto a machine as the user. I go into the "deleted items" bin in Outlook 2010, click the folder tab, then click the "Recover deleted items" button. Sure enough, the 2 messages from the sender are in here. I recover the deleted items and they show up in the deleted items bin as unread messages.
The user claims she didn't delete them.
There are no server side or client side rules in play from what I can tell.
So how is it possible for these incoming messages to completely bypass the inbox & deleted items folder and only show up in the "Recover Deleted Items" section?
The obvious answer to me was the user did a "Shift + Del" and deleted the items... however I'm inclined to believe the user who says she didn't do that (or even know about shift + Del). How else could this have happened?

 

[irbk]

Oh, I should also mention that this only seemed to happen to 2 e-mails. The same sender was able to reply to a message from the user and the user was able to get a message ok. It was 2 new messages (an original new message and a forward of the original new message) that seemed to bypass the inbox and deleted items heading straight to the "recover deleted items" bin.

 

[Zelandakh]

Enable mailbox auditing for the user and have the external person send them another email.

 

[irbk]

That external person was able to send her mail after that... or at the very least was able to reply to a message she sent. Not sure if it was a "one time" thing or if it's specifically confined to that sender. I'll see if the sender is willing to help out by sending some "new" (meaning not replying to any) messages to the user and see what I can come up with.

 

[irbk]

Ok, user has now said that she's seen several other e-mails completely bypass her inbox. How does one go about turning on mailbox auditing and can I leave that on for an extended period of time without overwhelming the logs?

 

[joepc]

Check Outlook rules. Also check the Outlook junk mail settings, you can set junkmail to perminately delete messages that it think is spam.

 

[irbk]

Joepc - Rules were the first thing that I checked. There are none.

 

[Zelandakh]

Full instructions from Andy Grogan are here

http://www.msexchange.org/articles_...wershell-simplify-mailbox-auditing-part1.html

 

[irbk]

Thank's much for the link!

 

[irbk]

Sweet mother of God. This is the SIMPLIFIED version?

 

[irbk]

Crud, part 2 or 3 hasn't been written yet. Guess I should have checked that first before I spent the last 3.5 hours trying to get the script prerequisites running on my system.

 

[irbk]

This link looks like it's got the information I need.

http://exchangeserverpro.com/exchange-2010-mailbox-audit-logging

I've got the logging turned on, now all I need is for the situation to recreate itself so I can see what got deleted. Unfortunately I can't recreate the issue on demand.

 

[Zelandakh]

Good luck with it.

 

[irbk]

Thanks!