Hi AholicLiang-MSFT,
I appreciate your help in this case.
We have Exchange Hybrid (Exchange Online + Exchange 2016)
I most cases user replays to the email communication, so each email Title starts with RE: , userX is not selected as recipient.
I have carefully checked all enabled mail flow rules (on both exchange online and exchange 2016) and did not find anything regarding userX.
When doing a trace in exchange Online for each reported case, I can see that email was also sent to userX even though userX was not recipent.
I have few copies of these emails and userX is not there.
When checking these emails on our 3th party Email Security Platform I can see these emails are coming Inbound through Email Security Platform to Exchange 2016, the NDR message says Exchange 2016. (usually if the email is sent to corporate user that communication is not visible on 3th pary Email Security Platform, only incoming and outgoing emails which traverses through Email Security platform).
The interesting fact is that not everyone experience this issue (from the logs I know that around 25 ppl has received that NDR message so far)
Could this be caused by misconfiguration somewhere?
Regards,
Przemek