I would suggest you enable the pipeline tracing log on your Exchange server to check if the changes are made before or after the mail coming into Exchange server.
Pipeline tracing captures copies of email messages from a specific sender as they move through the Transport service on Mailbox servers, the Mailbox Transport Delivery service on Mailbox servers, and through Edge Transport servers. Pipeline tracing captures verbose information about the changes that each transport agent applies to messages in the transport pipeline in message snapshot files. By examining the contents of the message snapshot files, you can determine whether the transport agents have applied the changes to the messages in the transport pipeline that you expected. If you are troubleshooting a problem, you should determine which transport agent is at fault. Then you can focus your troubleshooting efforts on that agent to resolve the problem. You can then view the message snapshot files again to verify that your solution is successful.
Step 1: Use the Exchange Management Shell to configure the pipeline tracing sender address
Set-TransportService Mailbox01 -PipelineTracingSenderAddress ******@external.com
Step 2: (Optional) Use the Exchange Management Shell to specify a custom pipeline tracing folder
Set-TransportService Mailbox01 -PipelineTracingPath "D:\Hub\Pipeline Tracing"
Step 3: Use the Exchange Management Shell to enable pipeline tracing
Set-TransportService Mailbox01 -PipelineTracingEnabled $true
Refer to the official document to get more information:
1. Pipeline tracing
2. Exchange Server: Configure pipeline tracing
Because of the disk space and security concerns associated with pipeline tracing, pipeline tracing is a temporary action for diagnostic or troubleshooting purposes. Whenever you enable pipeline tracing, always remember to disable it when you are finished.
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.