So one user started to received spam including zip files containing malware.
The email now says that the email came from herself... such a@a.com sent to a@a.com
It is very unlikely that she or a malware on her computer is creating those emails
And for some reason, even though much of the spam gets scan and delete by the anti-virus ....this one gets through
On Exchange 2010 I could use the Message Tracking tool that would allow to see pretty much anything about the email...from what I remember
The Message Tracking tool isn't anymore on Exchange 2013 (pretty stupid) and using the || Get-MessageTrackingLog -Start "2016-03-18 11:25:00" -End "2016-03-18 11:45:00" | Out-GridView || isn't giving me anymore information that was I was able to see in the email
The source code of that email isn't saying anything within the mailbox of that user
So how do I get to know where this email came from...?
Thank you