We're going to make sure their machine and outlook is down over the weekend. If it happens again, we'll go from there.
We also just found out that they have POP3 and IMAP4 enabled on exchange. I'm checking any policies associated with that. Most of our users don't have that. We use a 3rd party to allow mobile devices access to exchange. This user doesn't have that and yet still receives email. The two may be related but I'm not sure how.
1. We've already done that. And checked rules and any ignores.
2. That's the next step. They're a new employee so this is still viable.
3. We do with VEEAM, but the memory required to restore a single mailbox isn't something our exchange can handle and we don't have a test box to push it to. We do have the 14 day recovery so they aren't without it, just inconvenient at this point.