Hello everyone. Am facing the strange issue for one of my user. She is saying that the other user (receiver) was received the two emails(Same Email) from the user (sender) where she is not sent that those two emails from the outlook or either in owa. I checked the sent items of the sender outlook and found only one email is available in the sent items, The Other email is not there. I tracked the message with the subject line via command line . i got the event ID sating that the sender sent those email. but the user saying that she is not sent those emails really How this was happened. I checked the Internet Header and unable to find any thing. I suspect , this might be SPAM issue.

Message trackins show 2 messages were sent?

Nope Only One Email.

On Sun, 9 Jan 2011 12:46:19 +0000, rush2ramki wrote: > > >Hello everyone. > >Am facing the strange issue for one of my user. She is saying that the other user (receiver) was received the two emails(Same Email) from the user (sender) where she is not sent that those two emails from the outlook or either in owa. > >I checked the sent items of the sender outlook and found only one email is available in the sent items, The Other email is not there. > >I tracked the message with the subject line via command line . i got the event ID sating that the sender sent those email. but the user saying that she is not sent those emails really > >How this was happened. I checked the Internet Header and unable to find any thing. I suspect , this might be SPAM issue. Are both the sender and receiver in the same Exchange organization? Or is the receiver in some other e-mail system? --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Hi Rich... Same Exchange Organization.....

Here is how I would proceed with troubleshooting Get the both the copies of the message from the recipient mailbox , open up the header and match the message IDs. If they’re same then look at the time when they’re submitted, by default exchange doesn’t accept the same message ID within an hour and deletes the duplicate . If message ID is diff then you need to see various places…first check how the message was sent..? Was it sent to distribution list..? Use MFCMapi tool( http://mfcmapi.codeplex.com/ ) & look at the SMTP temp table to see if the message exists there…If for some reason message is stuck in there then it’ll be resend….this behavior could be because of antivirus scanning etc….Make sure exclusions are set correctly. Are the sender and recipient exit on different offices separated by firewall then there could be retransmission at router level that could trigger that. Some ref: http://technet.microsoft.com/en-us/library/dd577073(EXCHG.80).aspx Regards, Pushkal MishrA

Here is how I would proceed with troubleshooting Get the both the copies of the message from the recipient mailbox , open up the header and match the message IDs. If they’re same then look at the time when they’re submitted, by default exchange doesn’t accept the same message ID within an hour and deletes the duplicate . If message ID is diff then you need to see various places…first check how the message was sent..? Was it sent to distribution list..? Use MFCMapi tool( http://mfcmapi.codeplex.com/ ) & look at the SMTP temp table to see if the message exists there…If for some reason message is stuck in there then it’ll be resend….this behavior could be because of antivirus scanning etc….Make sure exclusions are set correctly. Are the sender and recipient exit on different offices separated by firewall then there could be retransmission at router level that could trigger that. Some ref: http://technet.microsoft.com/en-us/library/dd577073(EXCHG.80).aspx Regards, Pushkal MishrA

On Sun, 9 Jan 2011 19:56:44 +0000, rush2ramki wrote: > > >Hi Rich... > >Same Exchange Organization..... You said: "i got the event ID sating that the sender sent those email. but the user saying that she is not sent those emails really" So you see the same message sent twice from the originator? There are two message tracking logs, one for the HT (the file name starts with "MSGTRK") and one for the MBX role (the file name starts with "MSGTRKM"). The log file on the MBX role will contain the "SUBMIT" event for each message. Do you see two SUBMIT events when you look for the message? In the HT log, do you see two DELIVER events for the messae? --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Hi Team Found the two emails was received from the sender is in Different date. One is this for this month and another is last month (where i cannot track since the MT logs has deleted after 14 days) for this month , i saw the MT tracking information stating that , the store drive has been picked the email from the sender mailbox and deliver to the receipent mailbox..

On Mon, 10 Jan 2011 11:23:57 +0000, rush2ramki wrote: > > >Hi Team > >Found the two emails was received from the sender is in Different date. One is this for this month and another is last month (where i cannot track since the MT logs has deleted after 14 days) > >for this month , i saw the MT tracking information stating that , the store drive has been picked the email from the sender mailbox and deliver to the receipent mailbox.. So you see multiple SUBMIT events for the same message? And you see multiple DELIVER events for that message? And both messages have the same message-id? --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Yes Rich, All the Messages are having the same message ID.

Like I had said in my previous email, use MFCMapi and look at the SMTP Temp table, you may potentially find that message... Also recreating the SMTP Temp table may also help you resolve this issue!Regards, Pushkal MishrA

On Tue, 11 Jan 2011 13:56:45 +0000, rush2ramki wrote: >All the Messages are having the same message ID. That answered the 3rd question. What about the other two? The SUBMIT events would point to a problem at the client. Multiple DELIVER events with just a single SUBMIT event would point at the HT. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Hello Team Finally i had convinced the user , saying that , The Message could be corrupted ,and asked the user to delete the email from the sent items. He had deleted the same from his sent items and keep monitoring. Will see....Hopefully it should not be send it again.. Thanks all.