On Friday I came across something that stumped me completely. Here's what happened.

A user called me to take a look at a few of her computer issues. One of them was something puzzling that was happening with her email.

Over the past couple days, a couple people in her family were emailing her to ask why she was sending very old emails. She looked at the emails they were talking about, and recognized them as emails she had indeed sent a long time ago (like 14 months). Here's where it gets weird:

- the emails were received by the family member in the middle of the night, but the user always turns her computer off at night.
- the user remembers sending the email out originally, but now the original doesn't show up in her sent items either on her email client or on her webmail client (it's a Verizon email address).
- they don't appear in sent items either on their original date or the new one.

Any ideas? I'm trying to think of other symptoms, but if you have any questions I'll try to answer them.

I also feel like I'm missing something obvious...

I don't think this has anything at all to do with your user, but may have everything to do with her recipients. Might be a fluke that more than one of them had this happen, but less of a fluke if those people are using the same email system (are they?)

Maybe someone somewhere accidentally restored the spool folder on an email server with a very old backup ?

A copy of the full headers from the emails would help resolve the mystery.

If you have access to one of the received e-mail, check the full headers. It should contain timestamps along with every mail server that touched the message, to help point to what happened.

Keep in mind that forwarding the message will not keep the headers.

It will if you use a real email client (that is, pretty much anything but Outlook) and forward as an attachment.

In defence of Outlook:

1) if you create an email and drag and drop any other email into it, it will add it as an attachment.
2) if you select more than one email and forward it, it will forward them as attachments
3) under Tools->Options->Email Options, there is an option to attach when forwarding.

If you keep (and have access to) reasonably detailed smtp logs, you can see if the message originated from your network, even if you can't get your hands on the headers.

I had this happen once in a blue moon on my old system. Never figured exactly what was happening, but the messages did, in fact, originate internally. I suspected an odd interaction between the nightly backup, the nightly av scan, and the email datastore, but could never prove it and noone wanted to take ownership.

-jk

Fair enough. Just tested it in Outlook '07 and you're right. I don't think it used to have that feature, though.

Of course, if you're using Exchange, there's no guarantees about the accuracy of the RFC2822 headers.

On the contrary, I think it's pretty much guaranteed that it will bork them.

I was looking at Outlook 2003 actually. I'm pretty sure 2002 and 2000 also were OK. They had significant issues using Exchange remotely though. MS basically gives away Outlook 2003 licenses to Exchange users I think.

There are things I don't like for sure with Exchange/Outlook but I still find it does a lot. And in a >300k employee company, I don't have a lot of swing in the matter

As for the original issue, I can only suspect a backup restore.