Hello @Glenn Maxwell ,
According to your problem description, in Exchange 2016, you can track messages to find out how they were routed and to which distribution lists (DLs) they were delivered, which can help you identify which DL the user is a part of that is causing them to receive the emails.
I suggest you can follow the steps below:
1.Use the ‘Get-MessageTrackingLog’ cmdlet to search for the message using the message ID provided by the user. Here's an example of the command you might run:
Get-MessageTrackingLog -MessageId "<Message-ID-Here>" | Select-Object Timestamp, Source, EventId, MessageSubject, Sender, Recipients | Format-List
- This will show you a list of events for this message, including where it was routed and which recipients were resolved. Look for events with the EventId ‘Expand’ as these will show you when a DL was expanded to individual recipients.
- Once you've found the ‘Expand’ events, you can see to which DLs the message was sent and check the ‘Recipients’ field to see which members received the message. Look for the email address of the user who wants to be removed.
- After identifying the correct DL, use Exchange Management Console or Exchange Admin Center to remove the user from that specific DL.