Mysterious outbound email

[Diblik]

An individual outside of our company claims they
received an email from one of our employees. The
employee did not send the message. No message in his
Sent folder, nor was he even logged in the system when
these messages were delivered. The employee is a trusted
person. This has happened 3 times over the last two
months, the emails have no content or subject matter but
the recipient relied to each asking who are you and what
do you want. Here is my question: How can I tell if
these messages where sent from my server? and/or How
can I test the validity of the messages received by the
outside person. Any ideas would be helpful!
TIA

 

[jacktar]

If the recipient views the headers in the original email (and hopefully forwards them to you), you should see which mailservers handled it. Assuming he's using Outlook, select 'View/Options'. The headers are in the large textbox. Tell him to copy to an email and forward.

You might be lucky, the 'imposter' might be doing this from home!!

Good luck

 

[Diblik]

Thanks for the tip - but the text box is completely empty! (I've checked other messages and see what you mean) Is there a way to delete this info?

 

[ChrisHirst]

If the Internet Header text box is empty the messages have not been passed through any SMTP or POP mail servers. Every server puts some identification header to the message. AFAIK The only time these headers would be blank is on direct mail transfers eg between mailboxes on the same server on server to server through a x400 connector

 

[Diblik]

Would it be true that when you forward a message you lose the header info? (at least the parts from the original/previous message) The message(s) in question did pass thru our SMTP server for sure based on our employee responding to the inbound email asking him why he sent the email.

 

[SteveTheGeek]

Hmmmm... I'm thinking virus/worm. Scan your user's machine with an up-to-date antivirus scanner.
-Steve

 

[Diblik]

No virus on user's PC- checked and scaned with latest antivirus.

 

[ChrisHirst]

Diblik.
Yes you do lose the headers when you forward a message, What you need is the recipient to copy & paste the headers from the original message into a e-mail to yourself or the sopposed sender.

Chris

 

[pesh]

The headers from the recipients email should give you the info ou need.
I would also check the exchange server tracking logs (if you have it enabled).
Then check the smtp logs of the exchange server and any other smtp relays/gateways under your control. This should acertain whether the emails were sent through your servers.