Mysterious email sent from my account

[davidnbm]

My colleague came to me on Thursday saying he did not know what I was talking about in my email to him. I was puzzled as I had not sent him any email. Picked my phone and checked my inbox, finding an email from him. It was his response to the email I had allegedly sent, and I can see, below his response, the original message which has my email account as originator. Further below, details from an Outlook meeting invite I had sent earlier that day to another colleague.

I did not send that email. I checked my "sent" folder and it is not there. No one had access to my device to be able to send it from my account. Also, there are no permissions for other users. From the content, the person who wrote it using my account address has to be a co-worker, this is clear.

I was shocked and started researching about it. The only possibility I found so far is someone else having "send as" rights without my knowledge. I would like to know:

1 - is there any kind of Outlook glitch that could justify this event?
2 - if there is no glitch, any other possibilities besides the "send as" hypothesis?
3 - if the "send as" rights are enabled to someone else in the company, how can I find about it and see who that is?
4 - would an ordinary user be able to enable such "send as" rights, or would it require some IT person with special admin access?
5 - how can I protect myself from it as someone else might send an inappropriate email as if I had done it?

Really appreciate any assistance. Thank you,

 

[Diane Poremsky]

1 - is there any kind of Outlook glitch that could justify this event?
Generally speaking, no. But macros can; Exchange can send text reminders but they are from a system or admin account. The sent item should be in your sent folder though.

did you check the header on the message the recipient received? This would tell you if it came from your server.

2 - if there is no glitch, any other possibilities besides the "send as" hypothesis?
someone hacked your account if it came from your server.

3 - if the "send as" rights are enabled to someone else in the company, how can I find about it and see who that is?
it would show on calendar properties - right click on the calendar, choose properties. look on permissions.

4 - would an ordinary user be able to enable such "send as" rights, or would it require some IT person with special admin access?
only admins or mailbox owners (you) can give permission to your mailbox.

5 - how can I protect myself from it as someone else might send an inappropriate email as if I had done it?
you really can't - anyone with a smtp server can fake your from address and send mail that appears to be from you. Make sure you have a hard-to-guess password and change it now and again so no one can hack it.

 

[davidnbm]

Diane, appreciate your help. I have replicated exactly what I see in my Inbox in the PDF attached.

Brief recap:
1 - I had sent a meeting invite to Person H earlier that day.
2 - Person L, who is not a participant of the meeting, forwarded it to Person B, triggering Exchange Server to send me a notification, which is the email received at 11:40am (orange in the PDF). So far, everything makes sense, anyone in my group can see each other's calendar (read, but not write), so Person L could have checked my calendar and forwarded that invite. I, as the organizer, got a notification from Outlook, as it should be.
3 - I received the 12:13pm email, in which Person B writes to me: "Not sure". This is in response to the email in red, which is the mysterious email - I did not write it, not in my Sent folder, etc.

Given the meeting forward notification, it is very likely that Person L is the one who actually wrote the email in red to Person B. But how can Person L send an email that Person B receives displaying my name and email as originator, and that I actually receive the response for from Person B?

Everybody mentioned here works for the same company, these are all same company email accounts. No one is involved with IT in the company to have any special admin rights.

I checked the Calendar properties/Permissions and there is nothing unusual, just a default read-only level permission.

I am asking myself how Person L could send an email as if it was me, given all indication Person L does not have that right, at least not explicitly. Potential glitch? Person L is a highly skilled Outlook user? My company IT allows Person L to control my Outlook account without my knowledge?

 

[Diane Poremsky]

Given the meeting forward notification, it is very likely that Person L is the one who actually wrote the email in red to Person B. But how can Person L send an email that Person B receives displaying my name and email as originator, and that I actually receive the response for from Person B?

What permissions does everyone have on your calendar? do you have any delegates? if a person has the right permissions or has delegate permissions, and send as permissions, they can send from you.

A lot of people share calendars using delegate permission - that should only be used for delegates. Calendar should be shared using calendar sharing or by changing permissions on the calendar directly.

 

[davidnbm]

Hi there, attached are print screens of my setup for permissions and delegates. As is, it should not allow anyone to "send as" from my account, right?