Hi @Peter R
Have you used Exchange On-premises Mitigation Tool or Microsoft Safety Scanner to scan your Exchange server and check if there are some malware scripts?
If haven't yet, please follow the guide in this link and refer to the Have I been compromised? part:
Guidance for responders: Investigating and remediating on-premises Exchange Server vulnerabilities
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.