...and don't forget the PA's / EA's / Secretaries who may have Send As permissions to the bosses mailbox.
You could also try and recover from the deleted items if your still within your deleted item retention period to see if they did send the message, but deleted it. The user could of course be lying (shock horror), and he did send a job opportunity email because he wants to see the back of this sales manager. *grin* Glenn ----- Original Message ----- From: "Ed Crowley" <[EMAIL PROTECTED]> To: "Exchange Discussions" <[EMAIL PROTECTED]> Sent: Sunday, March 23, 2003 7:25 AM Subject: RE: Mailbox Hacked > Look at the message headers to be sure that it isn't from the Internet. > If it is from the Internet, search TechNet for "ResolveP2" (without the > quotes) and you can make sure that mail from the Internet doesn't look > like mail from within. If you determine that the message was generated > internally, then you should strap every administrator who could grant > themselves permissions to send as the manager into a lie detector and > terminate the one who fails. If they all pass, then you should tighten > up your security by eliminating unnecessary administrative accounts and > changing passwords on the remaining ones. > > Ed Crowley MCSE+Internet MVP > Freelance E-Mail Philosopher > Protecting the world from PSTs and Bricked Backups!T > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Sanjeev Sharma > Sent: Saturday, March 22, 2003 12:18 PM > To: Exchange Discussions > Subject: Mailbox Hacked > Importance: High > > > One of our sales managers received an email message from his boss about > a job opportunity in another company and the boss claiming that his > mailbox is hacked and he never sent that message which I believe that > because why would any manager do that. Now, the very first thing came to > mind that someone got into his mailbox and sent that message but what's > strange is that I got into his mailbox and browsed through his sent > items and I do not see that message in his sent items. I can't think of > anything else. Please help me understand that how can it be possible? > Thanks! > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] > > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
