Hi, We're running Exchange Enterprise 2003 SP2 on Windows 2003 Ent. SP2. Las friday at 3:17:36PM EST, the server sent 4 email that were already sent. All from the same sender to different recepient. The thing is that these messages werte deleted from the user mailbox for a while. She does'nt keep anything older than 2 months and some of the messages were sent at the beginning of 2007. I know that no one touched her computer cause I was in her office at taht particular time. I've checked in the users sent items and the 4 email were not here. Also checked in OWA log but no entry related to this particular user. The only user that logged this day do not have any "send as"permission. I cans trace the four messages in the tracking center and in the .log file and everything seems "normal". Is there aI canpinpoint the workstation IP it was sent from? Also, We've installed a BES Server two days ago. It is the only service I can think of capable of sending as a user, but I can't see nothing in the BES Logs either. What can cause this behaviour? Anyway I can prevent it? Anyway I can trace the source of the message? Thanks Fred

Your situation: there've 4 mails been auto-resented but those mails have already been deleted from sender user's "sent items" before. Its told these mails were coming from sender user by "msg tracking center". You want to know, is there any explanation for this symptom? The symptom will happen if those mails stuck in TEMP table before. Please check by using MFCMAPI 1. login to a pc with admin account, create a test user's OL profile, run MFCMAPI 1. "Session" menu->logon and display store table 2. "MDB" menu->get mailbox table 3. Double-click the object which display name is "SMTP...." 4. expand tree to temptable->double-click temptable again to see if there's stuck mail in (Delete if has) 5. restart SMTP service MFCMapi/Mapi Editor can be downloaded from: http://www.microsoft.com/downloads/details.aspx?FamilyID=55fdffd7-1878-4637-9808-1e21abb3ae37&DisplayLang=en You can find the IP address of sender from those sent mail's "internet header" 1. run OL 2. right-click the mail->option 3. The first 'Received' Header containing the IP address of the sender, which should be the oldest Received Header below those newer. PS: The options name may change as based on your OL version. OL2k3 is Option and 2k7 is message option

I've checked the temptable and there's no entry in it. Could a messgae be stalled in this queue for a year? The 4 messages were between 4 and 12 years old. I've checked the internet header of the 4 messages in outlook 2003, but it's blank. Probably due to the fact that the sender was on the same Exchange server/ Information store than the recepient? If the queue have no entry, could I safely assume that no more message like will be resent? Thanks! Fred

For your info, those mailss "internet header" was empty in recipient's inbox, right? If both of sender and recipient are MAPI users and stay on same server, header would be empty. You can check IP address if sender is POP3 user, sorry I didnt clear it before. 1. Those mails already gone from sender's mailbox, even from sender's archive? Please also check if those recipients got those mails before, is it the resend action to those recipients? 2. Please check sender's "Recover Deleted Items" a. choose "deleted items" folder b. go to "tools"->"Recover Deleted Items" 3. Try to recreate a new mailbox to sender with same name, in case the issue is related with mailbox a. Backup sender's mailbox file to a local PST b. Delete sender's mailbox in ADUC 1) locate sender in ADUC 2) right-click sender and choose "exchange task" 3) delete mailbox c. Purge sender's mailbox in EMS 1) locate sender's mailbox in EMS 2) run "clean agent" on "mailbox" level if you doesn't see a red-cross on sender's mailbox 3) right-click sender and choose "purge" d. Create new mailbox for sender in ADUC (also using "exchange task")