It seems the user had sent it to 6 recipients with 2 in the TO: and 4 in the CC:. The message was being sent every 15 mins. On looking at the message only the 4 addresses in the CC: were recieving this and the 2 people in the TO field were listed as ‘unknown’. Using Exchange Message Tracking, it showed it was the user sending it. Nothing in the Profile showed this message… Except the original.

However, on looking further into the message it was external causing the issue. The message ID had lotsofnumbers@servername.domain. The server name was an external one. Then in the message header of one of the emails, it showed the IP addresses it was really coming from. This again pointed to the external server.
Further check on the original showed one of the CC: was being changed to another name when sent every 15 mins.

After using ripe.net to find the Location and username, got in contact and now 2 hours later it is fixed.
Looks like it was a loop on the email address and the external server was supposed to recieve it but decided to forward it on thus it would resend every 15 mins…. and come back to itself. It would also keep the email in its original form of coming from the user and going to the 4 addresses.

Would check the original message sent.
As in our case the user said they never sent to the 4th address..but after restoring deleted items.. guess what we saw?
User is now checking their contacts….

Then see if you can get one of the message headers to see where it really is coming from.