A User Who Does Not Have Send As Rights Can Successfully Send a Meeting Request from an Exchange 2007 Mailbox
Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.
This topic explains why a user who does not have the "Send As" permission assigned may send a meeting request as another Microsoft Exchange Server 2007 user.
Consider the following scenario:
An Exchange 2007 mailbox (Mailbox A) is owned by User A
User B has access to Mailbox A. However, User B does not have "Send As" rights for User A.
In this scenario, when User B logs on to Mailbox A, User B cannot send an e-mail message as expected. However, User B can send a meeting request successfully.
You expect User B to receive an error message when User B tries to send the meeting request from this mailbox because User B does not have "Send As" rights for User A.
This behavior occurs because the Microsoft Exchange Information Store service does not perform "Send As" verification for operations that involve calendar items.
For More Information
This is the expected behavior in Exchange 2007. This behavior is intended to help an organization share resources, such as a conference room. For example, assume that an administrative assistant manages a conference room for an organization. To schedule a meeting in this conference room, the administrative assistant must use the mailbox account that is assigned to the conference room to send out a meeting request. Replies to this request are sent to the conference room mailbox, not to the administrative assistant's mailbox.