Today I got an email from a user saying she just received an internal email that was sent November 5th 2013. I tried using Exchange Tracking Log Explorer but nothing shows as being received on 11/5/13 and nothing from todays date that matches the Subject. Here are is the msg header which has been modified to hide our domain. This is a small business with 12 users with SBS 2011. This isn't the first time this has happened either. Another user had email delayed for 3 months.
work-SERVER2.work.local ([fe90::504b:b597:b89b:e7d9%10]) with mapi id
14.01.0438.000; Tue, 5 Nov 2013 08:38:41 -0900
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: USER NAME <sender@work.com>
To: USERS <recipient@work.com>
Subject: FW: INVOICE FROM ABC
Thread-Topic: INVOICE FROM ABC
Thread-Index: Ac7Z2hVrwb+u2RXnRA+qtd9tX4v5DAAc7eQA
Date: Tue, 5 Nov 2013 08:38:40 -0900
Message-ID: <BF122028D66EC74CBA777395B9BDC44201EB8BB1@work-SERVER2.work.local>
References: <009f01ced9da$2f37ff60$8da7fe20$@com>
In-Reply-To: <009f01ced9da$2f37ff60$8da7fe20$@com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <BF122028D66EC74CBA777395B9BDC44201EB8BB1@work-SERVER2.work.local>
MIME-Version: 1.0
X-MS-Exchange-Organization-AuthSource: work-SERVER2.work.local
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04
X-Originating-IP: [192.168.99.99]