Wouldn't it be in the header of the email when it was received ? CFee From: Fergal O'Connell [mailto:foconn...@curamsoftware.com] Sent: Wednesday, September 29, 2010 9:38 AM To: MS-Exchange Admin Issues Subject: Exchange 2007 Message tracking - find the source machine.
Hi, We have a user who said that an email was sent from his account to another external user. The email looks to be some sort of virus however it's only 1 email. The user claims he never sent the email- however there is not nothing in his sent items. Using message tracking I can see the email that was sent. Is there a way to find out what PC this email was sent from? I need to gather more information about how and why this email was sent from this account? Exchange 2007 Sp1 relaying email through an Ironport device. Regards Fergal O'Connell The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. If you are not the intended addressee please contact the sender and dispose of this e-mail. Thank you. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com<mailto:listmana...@lyris.sunbeltsoftware.com> with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe exchangelist
